redline | hxxp://147[.]182[.]180[.]78[:]8081

Resubmissions

25/04/2023, 21:52

230425-1q673ada87 6

24/04/2023, 07:06

230424-hw7rnsca7t 10

24/04/2023, 06:59

230424-hsa9asca5t 10

Analysis

max time kernel
1800s
max time network
1795s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
24/04/2023, 07:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://147.182.180.78:8081

Score

10^/10

redline infostealer

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 7 IoCs

resource	yara_rule
behavioral1/memory/4436-7423-0x000000001DDB0000-0x000000001DEF2000-memory.dmp	family_redline
behavioral1/memory/4436-8289-0x000000001EC50000-0x000000001ED50000-memory.dmp	family_redline
behavioral1/memory/4436-8701-0x000000001EC50000-0x000000001ED50000-memory.dmp	family_redline
behavioral1/memory/4436-8791-0x000000001EC50000-0x000000001ED50000-memory.dmp	family_redline
behavioral1/memory/4436-8890-0x000000001EC50000-0x000000001ED50000-memory.dmp	family_redline
behavioral1/memory/4436-8975-0x000000001EC50000-0x000000001ED50000-memory.dmp	family_redline
behavioral1/memory/4436-9078-0x000000001EC50000-0x000000001ED50000-memory.dmp	family_redline

Downloads MZ/PE file

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	Revenge-RAT v0.3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	Panel.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	Krumo.Loader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	Krumo.Loader.exe

Executes dropped EXE 29 IoCs

pid	Process
3024	ndp481-web.exe
4616	Setup.exe
4592	Email Spoofer.exe
1056	CraxsRat.exe
4436	Panel.exe
4536	Panel.exe
4608	build.exe
1456	Kurome.Builder.exe
4792	Kurome.Host.exe
1272	Krumo.Loader.exe
724	Rarqxqlarwy.exe
1804	Eihb.exe
3260	Krumo.Loader.exe
4012	Rarqxqlarwy.exe
3156	Rev-Builder.exe
3404	Revenge-RAT v0.3.exe
2472	Client.exe
2828	Client.exe
3672	GoRC.exe
184	Resource Hacker.exe
2592	dotNET_Reactor.exe
4732	Client.exe
1840	Revenge-RAT v0.3.exe
3884	Revenge-RAT v0.3.exe
1676	Revenge-RAT v0.3.exe
2820	CraxsRat V3.exe
1112	CraxsRat V3.exe
4868	ViottoBinder.exe
3336	BD2.Net Injector.exe

Loads dropped DLL 36 IoCs

pid	Process
4616	Setup.exe
4616	Setup.exe
4616	Setup.exe
4616	Setup.exe
1456	Kurome.Builder.exe
1456	Kurome.Builder.exe
4792	Kurome.Host.exe
4792	Kurome.Host.exe
4012	Rarqxqlarwy.exe
4012	Rarqxqlarwy.exe
4012	Rarqxqlarwy.exe
4012	Rarqxqlarwy.exe
2820	CraxsRat V3.exe
2820	CraxsRat V3.exe
2820	CraxsRat V3.exe
2820	CraxsRat V3.exe
2820	CraxsRat V3.exe
2820	CraxsRat V3.exe
2820	CraxsRat V3.exe
2820	CraxsRat V3.exe
2820	CraxsRat V3.exe
2820	CraxsRat V3.exe
2820	CraxsRat V3.exe
2820	CraxsRat V3.exe
2820	CraxsRat V3.exe
2820	CraxsRat V3.exe
2820	CraxsRat V3.exe
1112	CraxsRat V3.exe
1112	CraxsRat V3.exe
1112	CraxsRat V3.exe
1112	CraxsRat V3.exe
1112	CraxsRat V3.exe
1112	CraxsRat V3.exe
1112	CraxsRat V3.exe
4868	ViottoBinder.exe
4868	ViottoBinder.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

pid	Process
4436	Panel.exe
4436	Panel.exe
4436	Panel.exe
4436	Panel.exe
4436	Panel.exe
4436	Panel.exe
4436	Panel.exe
4436	Panel.exe
4436	Panel.exe
4436	Panel.exe
4436	Panel.exe
4436	Panel.exe
4436	Panel.exe
4436	Panel.exe
4436	Panel.exe
4436	Panel.exe
4436	Panel.exe
4436	Panel.exe
4436	Panel.exe
4436	Panel.exe
4436	Panel.exe
4436	Panel.exe
4436	Panel.exe
4436	Panel.exe
4436	Panel.exe
4436	Panel.exe
4436	Panel.exe
4436	Panel.exe
4436	Panel.exe
4436	Panel.exe
4436	Panel.exe
4536	Panel.exe
4536	Panel.exe
4536	Panel.exe
4536	Panel.exe
4536	Panel.exe
4536	Panel.exe
4536	Panel.exe
4536	Panel.exe
4536	Panel.exe
4536	Panel.exe
4536	Panel.exe
4536	Panel.exe
4536	Panel.exe
4536	Panel.exe
4536	Panel.exe
4536	Panel.exe
4536	Panel.exe
4536	Panel.exe
4536	Panel.exe
4536	Panel.exe
4536	Panel.exe
4536	Panel.exe
4536	Panel.exe
4536	Panel.exe
4536	Panel.exe
4536	Panel.exe
4536	Panel.exe
4536	Panel.exe
4536	Panel.exe
4536	Panel.exe
2820	CraxsRat V3.exe
2820	CraxsRat V3.exe
2820	CraxsRat V3.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4732 set thread context of 4436	4732	Client.exe	180
PID 4436 set thread context of 2608	4436	aspnet_compiler.exe	181

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll	Rarqxqlarwy.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll	Rarqxqlarwy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
2120	1804	WerFault.exe	142
2324	4436	WerFault.exe	133
1248	2820	WerFault.exe	198
3908	1112	WerFault.exe	202

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133268008048478409"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\34\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.Slider\CLSID\ = "{F08DF954-8592-11D1-B16A-00C0F0283628}"	ViottoBinder.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DD9DA666-8594-11D1-B16A-00C0F0283628}\VersionIndependentProgID\ = "MSComctlLib.ImageComboCtl"	ViottoBinder.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{66833FED-8583-11D1-B16A-00C0F0283628}\ProxyStubClsid32	ViottoBinder.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{35053A20-8589-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	ViottoBinder.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C74190B4-8589-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}"	ViottoBinder.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C74190B4-8589-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.0"	ViottoBinder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\30\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD9DA665-8594-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}"	ViottoBinder.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BDD1F051-858B-11D1-B16A-00C0F0283628}\TypeLib	ViottoBinder.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\41\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{66833FE4-8583-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.0"	ViottoBinder.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{35053A21-8589-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.0"	ViottoBinder.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C74190B8-8589-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}"	ViottoBinder.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDD1F055-858B-11D1-B16A-00C0F0283628}\TypeLib	ViottoBinder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\30\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Version = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202020202020202020202020202020202020202020202020202020202020202	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\43\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\45\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.TabStrip.2\CLSID\ = "{1EFB6596-857C-11D1-B16A-00C0F0283628}"	ViottoBinder.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.ProgCtrl	ViottoBinder.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE3F-8596-11D1-B16A-00C0F0283628}\InprocServer32\ = "C:\\Users\\Admin\\Downloads\\binder\\MSCOMCTL.OCX"	ViottoBinder.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1EFB6599-857C-11D1-B16A-00C0F0283628}	ViottoBinder.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\27\Shell	Revenge-RAT v0.3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDD1F04C-858B-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.0"	ViottoBinder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\27\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Revenge-RAT v0.3.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0\0\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\1\NodeSlot = "35"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\3\0\0\0	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E3867A3-8586-11D1-B16A-00C0F0283628}\ToolboxBitmap32	ViottoBinder.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\6	Revenge-RAT v0.3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\32\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\42\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DD9DA666-8594-11D1-B16A-00C0F0283628}\Version	ViottoBinder.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE36-8596-11D1-B16A-00C0F0283628}	ViottoBinder.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE3F-8596-11D1-B16A-00C0F0283628}\InprocServer32	ViottoBinder.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{66833FE4-8583-11D1-B16A-00C0F0283628}	ViottoBinder.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD9DA665-8594-11D1-B16A-00C0F0283628}	ViottoBinder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\31\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616193"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.TreeCtrl.2	ViottoBinder.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{66833FE9-8583-11D1-B16A-00C0F0283628}	ViottoBinder.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Revenge-RAT v0.3.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\43	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\Control	ViottoBinder.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DD9DA666-8594-11D1-B16A-00C0F0283628}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	ViottoBinder.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{66833FED-8583-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	ViottoBinder.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{35053A20-8589-11D1-B16A-00C0F0283628}	ViottoBinder.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDD1F050-858B-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}"	ViottoBinder.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C247F21-8591-11D1-B16A-00C0F0283628}	ViottoBinder.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F08DF954-8592-11D1-B16A-00C0F0283628}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352}	ViottoBinder.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE40-8596-11D1-B16A-00C0F0283628}	ViottoBinder.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{35053A20-8589-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}"	ViottoBinder.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C74190B5-8589-11D1-B16A-00C0F0283628}	ViottoBinder.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\42\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 0100000000000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\30\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0\0\MRUListEx = ffffffff	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.ImageListCtrl\ = "Microsoft ImageList Control 6.0 (SP6)"	ViottoBinder.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.ImageListCtrl.2\ = "Microsoft ImageList Control 6.0 (SP6)"	ViottoBinder.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8E3867A3-8586-11D1-B16A-00C0F0283628}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	ViottoBinder.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C74190B5-8589-11D1-B16A-00C0F0283628}	ViottoBinder.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2080	explorer.exe
4264	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
932	chrome.exe
932	chrome.exe
4616	Setup.exe
4616	Setup.exe
4616	Setup.exe
4616	Setup.exe
4616	Setup.exe
4616	Setup.exe
4616	Setup.exe
4616	Setup.exe
1664	chrome.exe
1664	chrome.exe
4436	Panel.exe
4436	Panel.exe
4436	Panel.exe
4436	Panel.exe
4436	Panel.exe
4436	Panel.exe
4436	Panel.exe
4436	Panel.exe
4436	Panel.exe
4436	Panel.exe
4436	Panel.exe
4436	Panel.exe
4436	Panel.exe
4436	Panel.exe
4436	Panel.exe
4436	Panel.exe
4436	Panel.exe
4436	Panel.exe
4436	Panel.exe
4436	Panel.exe
4436	Panel.exe
4436	Panel.exe
4436	Panel.exe
4436	Panel.exe
4436	Panel.exe
4536	Panel.exe
4436	Panel.exe
4536	Panel.exe
4436	Panel.exe
4536	Panel.exe
4436	Panel.exe
4536	Panel.exe
4436	Panel.exe
4536	Panel.exe
4436	Panel.exe
4536	Panel.exe
4436	Panel.exe
4536	Panel.exe
4436	Panel.exe
4536	Panel.exe
4436	Panel.exe
4536	Panel.exe
4436	Panel.exe
4536	Panel.exe
4436	Panel.exe
4536	Panel.exe
4436	Panel.exe
4536	Panel.exe
4436	Panel.exe
4536	Panel.exe
4436	Panel.exe
4536	Panel.exe

Suspicious behavior: GetForegroundWindowSpam 6 IoCs

pid	Process
3404	Revenge-RAT v0.3.exe
2080	explorer.exe
4264	explorer.exe
3884	Revenge-RAT v0.3.exe
632	OpenWith.exe
312	7zG.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
932	chrome.exe
932	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	932	chrome.exe
Token: SeCreatePagefilePrivilege	932	chrome.exe
Token: SeShutdownPrivilege	932	chrome.exe
Token: SeCreatePagefilePrivilege	932	chrome.exe
Token: SeShutdownPrivilege	932	chrome.exe
Token: SeCreatePagefilePrivilege	932	chrome.exe
Token: SeShutdownPrivilege	932	chrome.exe
Token: SeCreatePagefilePrivilege	932	chrome.exe
Token: SeShutdownPrivilege	932	chrome.exe
Token: SeCreatePagefilePrivilege	932	chrome.exe
Token: SeShutdownPrivilege	932	chrome.exe
Token: SeCreatePagefilePrivilege	932	chrome.exe
Token: SeShutdownPrivilege	932	chrome.exe
Token: SeCreatePagefilePrivilege	932	chrome.exe
Token: SeShutdownPrivilege	932	chrome.exe
Token: SeCreatePagefilePrivilege	932	chrome.exe
Token: SeShutdownPrivilege	932	chrome.exe
Token: SeCreatePagefilePrivilege	932	chrome.exe
Token: SeShutdownPrivilege	932	chrome.exe
Token: SeCreatePagefilePrivilege	932	chrome.exe
Token: SeShutdownPrivilege	932	chrome.exe
Token: SeCreatePagefilePrivilege	932	chrome.exe
Token: SeShutdownPrivilege	932	chrome.exe
Token: SeCreatePagefilePrivilege	932	chrome.exe
Token: SeShutdownPrivilege	932	chrome.exe
Token: SeCreatePagefilePrivilege	932	chrome.exe
Token: SeShutdownPrivilege	932	chrome.exe
Token: SeCreatePagefilePrivilege	932	chrome.exe
Token: SeShutdownPrivilege	932	chrome.exe
Token: SeCreatePagefilePrivilege	932	chrome.exe
Token: SeShutdownPrivilege	932	chrome.exe
Token: SeCreatePagefilePrivilege	932	chrome.exe
Token: SeShutdownPrivilege	932	chrome.exe
Token: SeCreatePagefilePrivilege	932	chrome.exe
Token: SeShutdownPrivilege	932	chrome.exe
Token: SeCreatePagefilePrivilege	932	chrome.exe
Token: SeShutdownPrivilege	932	chrome.exe
Token: SeCreatePagefilePrivilege	932	chrome.exe
Token: SeShutdownPrivilege	932	chrome.exe
Token: SeCreatePagefilePrivilege	932	chrome.exe
Token: SeShutdownPrivilege	932	chrome.exe
Token: SeCreatePagefilePrivilege	932	chrome.exe
Token: SeShutdownPrivilege	932	chrome.exe
Token: SeCreatePagefilePrivilege	932	chrome.exe
Token: SeShutdownPrivilege	932	chrome.exe
Token: SeCreatePagefilePrivilege	932	chrome.exe
Token: SeShutdownPrivilege	932	chrome.exe
Token: SeCreatePagefilePrivilege	932	chrome.exe
Token: SeShutdownPrivilege	932	chrome.exe
Token: SeCreatePagefilePrivilege	932	chrome.exe
Token: SeShutdownPrivilege	932	chrome.exe
Token: SeCreatePagefilePrivilege	932	chrome.exe
Token: SeShutdownPrivilege	932	chrome.exe
Token: SeCreatePagefilePrivilege	932	chrome.exe
Token: SeShutdownPrivilege	932	chrome.exe
Token: SeCreatePagefilePrivilege	932	chrome.exe
Token: SeShutdownPrivilege	932	chrome.exe
Token: SeCreatePagefilePrivilege	932	chrome.exe
Token: SeShutdownPrivilege	932	chrome.exe
Token: SeCreatePagefilePrivilege	932	chrome.exe
Token: SeShutdownPrivilege	932	chrome.exe
Token: SeCreatePagefilePrivilege	932	chrome.exe
Token: SeShutdownPrivilege	932	chrome.exe
Token: SeCreatePagefilePrivilege	932	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe

Suspicious use of SendNotifyMessage 45 IoCs

pid	Process
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
3404	Revenge-RAT v0.3.exe
3404	Revenge-RAT v0.3.exe
4264	explorer.exe
4264	explorer.exe
4264	explorer.exe
4264	explorer.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
932	chrome.exe
1840	Revenge-RAT v0.3.exe
1840	Revenge-RAT v0.3.exe
3884	Revenge-RAT v0.3.exe
3884	Revenge-RAT v0.3.exe
3884	Revenge-RAT v0.3.exe
1676	Revenge-RAT v0.3.exe
1676	Revenge-RAT v0.3.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3024	ndp481-web.exe
4436	Panel.exe
4536	Panel.exe
3404	Revenge-RAT v0.3.exe
2080	explorer.exe
2080	explorer.exe
3404	Revenge-RAT v0.3.exe
3404	Revenge-RAT v0.3.exe
4264	explorer.exe
4264	explorer.exe
4264	explorer.exe
4264	explorer.exe
4264	explorer.exe
4264	explorer.exe
4264	explorer.exe
4264	explorer.exe
4264	explorer.exe
4264	explorer.exe
4264	explorer.exe
4264	explorer.exe
4264	explorer.exe
4264	explorer.exe
4264	explorer.exe
4264	explorer.exe
4264	explorer.exe
2080	explorer.exe
2080	explorer.exe
2080	explorer.exe
2080	explorer.exe
2080	explorer.exe
2080	explorer.exe
2080	explorer.exe
2080	explorer.exe
2080	explorer.exe
2080	explorer.exe
2080	explorer.exe
2080	explorer.exe
2080	explorer.exe
2080	explorer.exe
2080	explorer.exe
2080	explorer.exe
2820	CraxsRat V3.exe
2820	CraxsRat V3.exe
2080	explorer.exe
2080	explorer.exe
2080	explorer.exe
2080	explorer.exe
1112	CraxsRat V3.exe
1112	CraxsRat V3.exe
2080	explorer.exe
2080	explorer.exe
2080	explorer.exe
2080	explorer.exe
2080	explorer.exe
2080	explorer.exe
2080	explorer.exe
2080	explorer.exe
2080	explorer.exe
2080	explorer.exe
2080	explorer.exe
2080	explorer.exe
2080	explorer.exe
2080	explorer.exe
632	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 932 wrote to memory of 3740	932	chrome.exe	83
PID 932 wrote to memory of 3740	932	chrome.exe	83
PID 932 wrote to memory of 2928	932	chrome.exe	85
PID 932 wrote to memory of 2928	932	chrome.exe	85
PID 932 wrote to memory of 2928	932	chrome.exe	85
PID 932 wrote to memory of 2928	932	chrome.exe	85
PID 932 wrote to memory of 2928	932	chrome.exe	85
PID 932 wrote to memory of 2928	932	chrome.exe	85
PID 932 wrote to memory of 2928	932	chrome.exe	85
PID 932 wrote to memory of 2928	932	chrome.exe	85
PID 932 wrote to memory of 2928	932	chrome.exe	85
PID 932 wrote to memory of 2928	932	chrome.exe	85
PID 932 wrote to memory of 2928	932	chrome.exe	85
PID 932 wrote to memory of 2928	932	chrome.exe	85
PID 932 wrote to memory of 2928	932	chrome.exe	85
PID 932 wrote to memory of 2928	932	chrome.exe	85
PID 932 wrote to memory of 2928	932	chrome.exe	85
PID 932 wrote to memory of 2928	932	chrome.exe	85
PID 932 wrote to memory of 2928	932	chrome.exe	85
PID 932 wrote to memory of 2928	932	chrome.exe	85
PID 932 wrote to memory of 2928	932	chrome.exe	85
PID 932 wrote to memory of 2928	932	chrome.exe	85
PID 932 wrote to memory of 2928	932	chrome.exe	85
PID 932 wrote to memory of 2928	932	chrome.exe	85
PID 932 wrote to memory of 2928	932	chrome.exe	85
PID 932 wrote to memory of 2928	932	chrome.exe	85
PID 932 wrote to memory of 2928	932	chrome.exe	85
PID 932 wrote to memory of 2928	932	chrome.exe	85
PID 932 wrote to memory of 2928	932	chrome.exe	85
PID 932 wrote to memory of 2928	932	chrome.exe	85
PID 932 wrote to memory of 2928	932	chrome.exe	85
PID 932 wrote to memory of 2928	932	chrome.exe	85
PID 932 wrote to memory of 2928	932	chrome.exe	85
PID 932 wrote to memory of 2928	932	chrome.exe	85
PID 932 wrote to memory of 2928	932	chrome.exe	85
PID 932 wrote to memory of 2928	932	chrome.exe	85
PID 932 wrote to memory of 2928	932	chrome.exe	85
PID 932 wrote to memory of 2928	932	chrome.exe	85
PID 932 wrote to memory of 2928	932	chrome.exe	85
PID 932 wrote to memory of 2928	932	chrome.exe	85
PID 932 wrote to memory of 1344	932	chrome.exe	86
PID 932 wrote to memory of 1344	932	chrome.exe	86
PID 932 wrote to memory of 180	932	chrome.exe	87
PID 932 wrote to memory of 180	932	chrome.exe	87
PID 932 wrote to memory of 180	932	chrome.exe	87
PID 932 wrote to memory of 180	932	chrome.exe	87
PID 932 wrote to memory of 180	932	chrome.exe	87
PID 932 wrote to memory of 180	932	chrome.exe	87
PID 932 wrote to memory of 180	932	chrome.exe	87
PID 932 wrote to memory of 180	932	chrome.exe	87
PID 932 wrote to memory of 180	932	chrome.exe	87
PID 932 wrote to memory of 180	932	chrome.exe	87
PID 932 wrote to memory of 180	932	chrome.exe	87
PID 932 wrote to memory of 180	932	chrome.exe	87
PID 932 wrote to memory of 180	932	chrome.exe	87
PID 932 wrote to memory of 180	932	chrome.exe	87
PID 932 wrote to memory of 180	932	chrome.exe	87
PID 932 wrote to memory of 180	932	chrome.exe	87
PID 932 wrote to memory of 180	932	chrome.exe	87
PID 932 wrote to memory of 180	932	chrome.exe	87
PID 932 wrote to memory of 180	932	chrome.exe	87
PID 932 wrote to memory of 180	932	chrome.exe	87
PID 932 wrote to memory of 180	932	chrome.exe	87
PID 932 wrote to memory of 180	932	chrome.exe	87

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://147.182.180.78:8081
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff90d0b9758,0x7ff90d0b9768,0x7ff90d0b9778
  2⤵
  PID:3740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1800 --field-trial-handle=1756,i,12560564167066438246,1400599712417211167,131072 /prefetch:2
  2⤵
  PID:2928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1756,i,12560564167066438246,1400599712417211167,131072 /prefetch:8
  2⤵
  PID:1344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2172 --field-trial-handle=1756,i,12560564167066438246,1400599712417211167,131072 /prefetch:8
  2⤵
  PID:180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2940 --field-trial-handle=1756,i,12560564167066438246,1400599712417211167,131072 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2956 --field-trial-handle=1756,i,12560564167066438246,1400599712417211167,131072 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4744 --field-trial-handle=1756,i,12560564167066438246,1400599712417211167,131072 /prefetch:8
  2⤵
  PID:4792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4864 --field-trial-handle=1756,i,12560564167066438246,1400599712417211167,131072 /prefetch:8
  2⤵
  PID:3736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5204 --field-trial-handle=1756,i,12560564167066438246,1400599712417211167,131072 /prefetch:8
  2⤵
  PID:1244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5172 --field-trial-handle=1756,i,12560564167066438246,1400599712417211167,131072 /prefetch:8
  2⤵
  PID:4776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 --field-trial-handle=1756,i,12560564167066438246,1400599712417211167,131072 /prefetch:8
  2⤵
  PID:3760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5160 --field-trial-handle=1756,i,12560564167066438246,1400599712417211167,131072 /prefetch:8
  2⤵
  PID:2604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5040 --field-trial-handle=1756,i,12560564167066438246,1400599712417211167,131072 /prefetch:8
  2⤵
  PID:3120
- C:\Users\Admin\Downloads\ndp481-web.exe
  "C:\Users\Admin\Downloads\ndp481-web.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3024
- - C:\14c287f3e0f84e816f158b7b48\Setup.exe
    C:\14c287f3e0f84e816f158b7b48\\Setup.exe /x86 /x64 /web
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:4616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1584 --field-trial-handle=1756,i,12560564167066438246,1400599712417211167,131072 /prefetch:8
  2⤵
  PID:1996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5536 --field-trial-handle=1756,i,12560564167066438246,1400599712417211167,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4652 --field-trial-handle=1756,i,12560564167066438246,1400599712417211167,131072 /prefetch:8
  2⤵
  PID:1440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 --field-trial-handle=1756,i,12560564167066438246,1400599712417211167,131072 /prefetch:8
  2⤵
  PID:4892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 --field-trial-handle=1756,i,12560564167066438246,1400599712417211167,131072 /prefetch:8
  2⤵
  PID:1728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1728 --field-trial-handle=1756,i,12560564167066438246,1400599712417211167,131072 /prefetch:8
  2⤵
  PID:1668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 --field-trial-handle=1756,i,12560564167066438246,1400599712417211167,131072 /prefetch:8
  2⤵
  PID:4960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2556 --field-trial-handle=1756,i,12560564167066438246,1400599712417211167,131072 /prefetch:8
  2⤵
  PID:2224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4680 --field-trial-handle=1756,i,12560564167066438246,1400599712417211167,131072 /prefetch:8
  2⤵
  PID:1748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 --field-trial-handle=1756,i,12560564167066438246,1400599712417211167,131072 /prefetch:8
  2⤵
  PID:3364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4428 --field-trial-handle=1756,i,12560564167066438246,1400599712417211167,131072 /prefetch:8
  2⤵
  PID:2640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4420 --field-trial-handle=1756,i,12560564167066438246,1400599712417211167,131072 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5656 --field-trial-handle=1756,i,12560564167066438246,1400599712417211167,131072 /prefetch:8
  2⤵
  PID:1120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=848 --field-trial-handle=1756,i,12560564167066438246,1400599712417211167,131072 /prefetch:8
  2⤵
  PID:1640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 --field-trial-handle=1756,i,12560564167066438246,1400599712417211167,131072 /prefetch:8
  2⤵
  PID:3596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=848 --field-trial-handle=1756,i,12560564167066438246,1400599712417211167,131072 /prefetch:8
  2⤵
  PID:2888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 --field-trial-handle=1756,i,12560564167066438246,1400599712417211167,131072 /prefetch:8
  2⤵
  PID:4076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 --field-trial-handle=1756,i,12560564167066438246,1400599712417211167,131072 /prefetch:8
  2⤵
  PID:4972

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4456

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2720

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Email Spoofer by\" -spe -an -ai#7zMap6030:94:7zEvent31465
1⤵
PID:5088

C:\Users\Admin\Downloads\Email Spoofer by\Email Spoofer.exe
"C:\Users\Admin\Downloads\Email Spoofer by\Email Spoofer.exe"
1⤵
- Executes dropped EXE
PID:4592

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\pico-ducky-v1.4_us\" -spe -an -ai#7zMap4836:98:7zEvent27732
1⤵
PID:896

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Cypher-Rat Latest Paid (3)\" -spe -an -ai#7zMap10788:114:7zEvent26227
1⤵
PID:1084

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Cypher-Rat Latest Paid (3)\Cypher-Rat Latest Paid\Cypher Source + Rat\" -spe -an -ai#7zMap20044:200:7zEvent386
1⤵
PID:1476

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Cypher RAT 2023\" -spe -an -ai#7zMap28778:92:7zEvent137
1⤵
PID:3108

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Cypher RAT 2023\Tools\" -spe -an -ai#7zMap27392:104:7zEvent7586
1⤵
PID:3616

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\original exe\" -spe -an -ai#7zMap18390:86:7zEvent27293
1⤵
PID:3868

C:\Users\Admin\Downloads\original exe\CraxsRat.exe
"C:\Users\Admin\Downloads\original exe\CraxsRat.exe"
1⤵
- Executes dropped EXE
PID:1056

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Redline\" -spe -an -ai#7zMap3613:76:7zEvent26512
1⤵
PID:4832

C:\Users\Admin\Downloads\Redline\Redline Steeler\Redline Steeler\Panel\RedLine_20_2\Panel\Panel.exe
"C:\Users\Admin\Downloads\Redline\Redline Steeler\Redline Steeler\Panel\RedLine_20_2\Panel\Panel.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4436
- C:\Users\Admin\Downloads\Redline\Redline Steeler\Redline Steeler\Panel\RedLine_20_2\Panel\Panel.exe
  "C:\Users\Admin\Downloads\Redline\Redline Steeler\Redline Steeler\Panel\RedLine_20_2\Panel\Panel.exe" "--monitor"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4536
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4436 -s 2272
  2⤵
  - Program crash
  PID:2324

C:\Users\Admin\Downloads\Redline\Redline Steeler\Redline Steeler\Kurome.Builder\build.exe
"C:\Users\Admin\Downloads\Redline\Redline Steeler\Redline Steeler\Kurome.Builder\build.exe"
1⤵
- Executes dropped EXE
PID:4608

C:\Users\Admin\Downloads\Redline\Redline Steeler\Redline Steeler\Kurome.Builder\Kurome.Builder.exe
"C:\Users\Admin\Downloads\Redline\Redline Steeler\Redline Steeler\Kurome.Builder\Kurome.Builder.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1456

C:\Users\Admin\Downloads\Redline\Redline Steeler\Redline Steeler\Kurome.Host\Kurome.Host.exe
"C:\Users\Admin\Downloads\Redline\Redline Steeler\Redline Steeler\Kurome.Host\Kurome.Host.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4792

C:\Users\Admin\Downloads\Redline\Redline Steeler\Redline Steeler\Kurome.Loader\Krumo.Loader.exe
"C:\Users\Admin\Downloads\Redline\Redline Steeler\Redline Steeler\Kurome.Loader\Krumo.Loader.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:1272
- C:\Users\Admin\AppData\Local\Temp\Rarqxqlarwy.exe
  "C:\Users\Admin\AppData\Local\Temp\Rarqxqlarwy.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:724
- C:\Users\Admin\AppData\Local\Temp\Eihb.exe
  "C:\Users\Admin\AppData\Local\Temp\Eihb.exe"
  2⤵
  - Executes dropped EXE
  PID:1804
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 1696
    3⤵
    - Program crash
    PID:2120

C:\Users\Admin\Downloads\Redline\Redline Steeler\Redline Steeler\Kurome.Loader\Krumo.Loader.exe
"C:\Users\Admin\Downloads\Redline\Redline Steeler\Redline Steeler\Kurome.Loader\Krumo.Loader.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:3260
- C:\Users\Admin\AppData\Local\Temp\Rarqxqlarwy.exe
  "C:\Users\Admin\AppData\Local\Temp\Rarqxqlarwy.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:4012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1804 -ip 1804
1⤵
PID:3784

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 524 -p 4436 -ip 4436
1⤵
PID:4260

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Redline\Redline Steeler\Redline Steeler\Password.txt
1⤵
PID:1880

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Redline\Redline Steeler\Redline Steeler\Panel\RedLine_20_2\FAQ.txt
1⤵
PID:1156

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Revenge_Clean-version\" -spe -an -ai#7zMap12311:104:7zEvent9841
1⤵
PID:1124

C:\Users\Admin\Downloads\Revenge_Clean-version\Rev-Builder\Rev-Builder.exe
"C:\Users\Admin\Downloads\Revenge_Clean-version\Rev-Builder\Rev-Builder.exe"
1⤵
- Executes dropped EXE
PID:3156

C:\Users\Admin\Downloads\Revenge_Clean-version\Revenge-RAT v0.3\Revenge-RAT v0.3.exe
"C:\Users\Admin\Downloads\Revenge_Clean-version\Revenge-RAT v0.3\Revenge-RAT v0.3.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3404
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe" /QUIET "C:\Users\Admin\AppData\Local\Temp\RV.IL" /output:"C:\Users\Admin\Desktop\Client.exe"
  2⤵
  PID:3192
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" /select,C:\Users\Admin\Desktop\Client.exe
  2⤵
  PID:4176
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe" /QUIET "C:\Users\Admin\AppData\Local\Temp\RV.IL" /output:"C:\Users\Admin\Downloads\Revenge_Clean-version\Revenge-RAT v0.3\Client.exe" /resource:Extensions\Admin.res
  2⤵
  PID:2996
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES56D8.tmp" "Extensions\Admin.res"
    3⤵
    PID:4600
- C:\Users\Admin\Downloads\Revenge_Clean-version\Revenge-RAT v0.3\Extensions\GoRC.exe
  Extensions\GoRC /r Extensions\Information.rc
  2⤵
  - Executes dropped EXE
  PID:3672
- C:\Users\Admin\Downloads\Revenge_Clean-version\Revenge-RAT v0.3\Extensions\Resource Hacker.exe
  "Extensions\Resource Hacker" -addoverwrite C:\Users\Admin\Downloads\Revenge_Clean-version\Revenge-RAT v0.3\Client.exe,C:\Users\Admin\Downloads\Revenge_Clean-version\Revenge-RAT v0.3\Client.exe,C:\Users\Admin\Downloads\Revenge_Clean-version\Revenge-RAT v0.3\Extensions\Information.res,VERSIONINFO,1,
  2⤵
  - Executes dropped EXE
  PID:184
- C:\Users\Admin\Downloads\Revenge_Clean-version\Revenge-RAT v0.3\Extensions\dotNET_Reactor.exe
  "C:\Users\Admin\Downloads\Revenge_Clean-version\Revenge-RAT v0.3\Extensions\dotNET_Reactor.exe" dotNET_Reactor.exe -file "C:\Users\Admin\Downloads\Revenge_Clean-version\Revenge-RAT v0.3\Client.exe" -antitamp[1] -suppressildasm[1] -obfuscate_public_types[1] -stringencryption[1] -obfuscation[1] -targetfile "C:\Users\Admin\Downloads\Revenge_Clean-version\Revenge-RAT v0.3\Client.exe"
  2⤵
  - Executes dropped EXE
  PID:2592
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" /select,C:\Users\Admin\Downloads\Revenge_Clean-version\Revenge-RAT v0.3\Client.exe
  2⤵
  PID:4644

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2080
- C:\Users\Admin\Desktop\Client.exe
  "C:\Users\Admin\Desktop\Client.exe"
  2⤵
  - Executes dropped EXE
  PID:2472
- C:\Users\Admin\Desktop\Client.exe
  "C:\Users\Admin\Desktop\Client.exe"
  2⤵
  - Executes dropped EXE
  PID:2828
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Cypher RAT 2023\Tools\Tools\Cypher Bind\Provider Code.txt
  2⤵
  PID:4512
- C:\Program Files\7-Zip\7zG.exe
  "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\CraxsRAT-license\" -spe -an -ai#7zMap1883:94:7zEvent4117
  2⤵
  PID:4612
- C:\Users\Admin\Downloads\CraxsRAT-license\CraxsRAT-Linuxndroid\CraxsRat V3.exe
  "C:\Users\Admin\Downloads\CraxsRAT-license\CraxsRAT-Linuxndroid\CraxsRat V3.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetWindowsHookEx
  PID:2820
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 1616
    3⤵
    - Program crash
    PID:1248
- C:\Users\Admin\Downloads\CraxsRAT-license\CraxsRAT-Linuxndroid\CraxsRat V3.exe
  "C:\Users\Admin\Downloads\CraxsRAT-license\CraxsRAT-Linuxndroid\CraxsRat V3.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:1112
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 1200
    3⤵
    - Program crash
    PID:3908

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4264
- C:\Users\Admin\Downloads\Revenge_Clean-version\Revenge-RAT v0.3\Client.exe
  "C:\Users\Admin\Downloads\Revenge_Clean-version\Revenge-RAT v0.3\Client.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:4732
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe"
    3⤵
    - Suspicious use of SetThreadContext
    PID:4436
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe"
      4⤵
      PID:2608
- C:\Users\Admin\Downloads\Revenge_Clean-version\Revenge-RAT v0.3\Revenge-RAT v0.3.exe
  "C:\Users\Admin\Downloads\Revenge_Clean-version\Revenge-RAT v0.3\Revenge-RAT v0.3.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SendNotifyMessage
  PID:1840
- C:\Users\Admin\Downloads\Revenge_Clean-version\Revenge-RAT v0.3\Revenge-RAT v0.3.exe
  "C:\Users\Admin\Downloads\Revenge_Clean-version\Revenge-RAT v0.3\Revenge-RAT v0.3.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SendNotifyMessage
  PID:3884
- C:\Users\Admin\Downloads\Revenge_Clean-version\Revenge-RAT v0.3\Revenge-RAT v0.3.exe
  "C:\Users\Admin\Downloads\Revenge_Clean-version\Revenge-RAT v0.3\Revenge-RAT v0.3.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SendNotifyMessage
  PID:1676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 2820 -ip 2820
1⤵
PID:3656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1112 -ip 1112
1⤵
PID:4536

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:632
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Redline\Redline Steeler\Redline Steeler\Panel\RedLine_20_2\Panel\telegramChatsSettings.json
  2⤵
  PID:2884

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\binder\" -spe -an -ai#7zMap12997:74:7zEvent13387
1⤵
PID:4548

C:\Users\Admin\Downloads\binder\ViottoBinder.exe
"C:\Users\Admin\Downloads\binder\ViottoBinder.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:4868

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\BD2.Net_Injector_By_BD2pass-123\" -spe -an -ai#7zMap31131:124:7zEvent4037
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:312

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\BD2.Net_Injector_By_BD2pass-123\" -spe -an -ai#7zMap24671:124:7zEvent18166
1⤵
PID:4928

C:\Users\Admin\Downloads\BD2.Net_Injector_By_BD2pass-123\BD2.Net Injector\BD2.Net Injector.exe
"C:\Users\Admin\Downloads\BD2.Net_Injector_By_BD2pass-123\BD2.Net Injector\BD2.Net Injector.exe"
1⤵
- Executes dropped EXE
PID:3336

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\14c287f3e0f84e816f158b7b48\1025\LocalizedData.xml

Filesize
81KB

MD5
ce5516f147138e45b53f87ccbf0605fd

SHA1
8789b4529028aa7e6a283cc99c2e5f6233af5aab

SHA256
b778f422f3c7c1637e70004dccd9d43ca22cb10008749f787daad7b56fe3d9ae

SHA512
d7881b770dff8a83fc3cc00fc0564c9208d93689daac16083c400c59805fd17173d7359c9877507997f1a2dd6241ebb9f2a7e67bec8ce1dbe81e63ecca777180

Download Submit
C:\14c287f3e0f84e816f158b7b48\1028\LocalizedData.xml

Filesize
69KB

MD5
d566bfc0bb35db1e85a708dc032a1611

SHA1
d3a97cdd07eabedb0e62a7f4ea3975fa24529d95

SHA256
73982dfb340cdc6543f65d9497ad81a63469f735471774d27368fcc1ed364a87

SHA512
f23927811b4116d606379da023e3014ef07e947b532d84107928bad1113913e69950143380da7341945f164be2dc581546eb5b746e595f8a1f04d97f237fa22f

Download Submit
C:\14c287f3e0f84e816f158b7b48\1029\LocalizedData.xml

Filesize
86KB

MD5
7589806e6a13583a9e54e0709c4321cc

SHA1
ab30aead9527ca8cc53c6a1af81ad5d6ae46832f

SHA256
26b8214f7e2783dd24b103056b61c1118aa8a6d4caea48e5b412b859661ccb30

SHA512
650dfa9ed56b217825d7861f166544973310c9061e0e962f68dac1b20607ca1949e3236423d2caf17df67a0f0734480ec9b54b3e3d6eacdb55e6cb3a8329dc4b

Download Submit
C:\14c287f3e0f84e816f158b7b48\1030\LocalizedData.xml

Filesize
84KB

MD5
b9ad5597f74b077b3f8f246e2fa084e9

SHA1
ee0eb6719e7e05b906308164705fa72253e7788f

SHA256
ebc9655ad04b1c816bf06dc9fb3b91532f54198f7e35f6c30b853beaad365c71

SHA512
56f648a9fb5effd59ae4313be87e1bd0abd3c5da7561dc944f0458ca8b32c01dffec789656f02f95e001ad2b581d40691707bf493a26e32b12d6b96a36b9f2fb

Download Submit
C:\14c287f3e0f84e816f158b7b48\1031\LocalizedData.xml

Filesize
89KB

MD5
589727c574e626feff865b6af99db9ca

SHA1
ee3ef27bfd6969cde46ca7ad285915c848c5ec83

SHA256
520efd4383e19e1acf27b6c2254b2ee98d8ecb943e537f534b0f21a3fd373687

SHA512
c3c4931aaecd742f4182f00b59a4e34a258e90c74cde68e9fc4e052c19c6033afb53bf824d93faf106122282f3d986a8d2c2927dfd6f26a3ff4633e0dde10b6c

Download Submit
C:\14c287f3e0f84e816f158b7b48\1032\LocalizedData.xml

Filesize
91KB

MD5
a80b6711237d690ba6cc19be34976763

SHA1
e9bf40839cbae95089b531045047e23e7897d139

SHA256
40f1297a444bc05d546e1998ae9682f656c24842c662f3afbd568adbe411ccab

SHA512
9eb39194352f1f4165c45603946ed021d646a1228dfa7ffcc46d2378bf79f2e484e9822bd4feb116b4d832bed8970a558a1617e9c2746c093a2e0acb77e26df8

Download Submit
C:\14c287f3e0f84e816f158b7b48\1033\LocalizedData.xml

Filesize
83KB

MD5
c5489cb5e748cb019fb2413d1a192aff

SHA1
a85b9c4d6b26d1bd183940ec9e4fa680cefe7f1b

SHA256
be78a418e3187dfeb2a994de43c9e4d2f12e8828a9af852dfb22ce290be54b87

SHA512
1a157a92fb45d762ad562c488a2f5ebfdffb931d1ba45abd493369bc5512d8989907ce8179916e4770e20eb2863a2cf121e4030ce17ff1272762bf85f8cc6d6f

Download Submit
C:\14c287f3e0f84e816f158b7b48\1033\SetupResources.dll

Filesize
24KB

MD5
77f7789767e1777c6a362411c6a4b281

SHA1
ba9b97307df05c56c8627f33c50dc8c5a7d88b48

SHA256
73cf574621249665f370d60f2d87731af30646098fa8216f64c4d191636f4f16

SHA512
7075db0f233324970a1512c8a3d581cae6a94d12e15b36b4d0b8777af098125e369b669cceeb934ce726ab18ccdec19323336369351678b03b38a638bade11d3

Download Submit
C:\14c287f3e0f84e816f158b7b48\1033\SetupResources.dll

Filesize
24KB

MD5
77f7789767e1777c6a362411c6a4b281

SHA1
ba9b97307df05c56c8627f33c50dc8c5a7d88b48

SHA256
73cf574621249665f370d60f2d87731af30646098fa8216f64c4d191636f4f16

SHA512
7075db0f233324970a1512c8a3d581cae6a94d12e15b36b4d0b8777af098125e369b669cceeb934ce726ab18ccdec19323336369351678b03b38a638bade11d3

Download Submit
C:\14c287f3e0f84e816f158b7b48\1035\LocalizedData.xml

Filesize
84KB

MD5
d16861902b60c01f42ce867e4d1687b1

SHA1
5d3e3411e295d175a7d0b48d31643337ca1fdd6d

SHA256
3e02b449ad6eaca610cf143d70d95a75a2317fb7f615541f70e9c533af53a852

SHA512
d624fe906142d35e4d514d3d85b5d5f8c10648b2216aa846b45e64d243ea32657496cfd62b5997f9b931ca21cc3c5df7ec1904233fa30288de66a69b2ff5ccfa

Download Submit
C:\14c287f3e0f84e816f158b7b48\1036\LocalizedData.xml

Filesize
88KB

MD5
f43ef6c1608b73e92e08d4939d141726

SHA1
eb04e19ca64ebe2c7e38f979f81e3e3260e64fcd

SHA256
2d25d78f2fae9d90cbddfcddcf24c528b25d94bb30f1b7316b4057d910354931

SHA512
a21332e5dd72eaa976609a9475b96357d5da88e4ed963d3f650ca0c11c392715d3948258d6a04256fa213122bf4a767833870e0a2d5668fe38a76ac0e1b0b2c0

Download Submit
C:\14c287f3e0f84e816f158b7b48\1037\LocalizedData.xml

Filesize
79KB

MD5
22bf13896cd9d4986eefca2968a102b1

SHA1
58613d8f1211d6d5804d7bcbcd38647f1c5209bc

SHA256
cd0ce70687664aea92eaf1b3cbd39a078300e054ebf4ff7ea34a5c904012527f

SHA512
8fe9c133a97f78e2fe8a0a6e0d89db600362b44c1bc0fe9eb78388d19a122059d4fbe14f6944541671f8e53ae293d52889ed424562c5a4e9a7e1acc95005b67a

Download Submit
C:\14c287f3e0f84e816f158b7b48\1038\LocalizedData.xml

Filesize
87KB

MD5
a49a093b9707e39ad7b33a90fbae9083

SHA1
32e852cd55dc5531156322072f183a2ba9932fdc

SHA256
657dddecb7aeab429d0b3661ff0632ae81dc8ce4f958a7a1e9765fb450e28abe

SHA512
6f410e6dff320cc3b3c4ddabaff23560204627df034575ecac176dad34a0381add77b7c84f73f5e268f05fc89ae962460d784f206b0e74645fd30d28b81b1482

Download Submit
C:\14c287f3e0f84e816f158b7b48\1040\LocalizedData.xml

Filesize
86KB

MD5
ad1499f7b01cba8c64b303b8c764cc93

SHA1
1e9799960e4ab6b23247d4be82c413e106306434

SHA256
707154c6cd08bf937a65689634bc399ace4a1f14a7ad7dbb0e7eb8c036b209dd

SHA512
3fea83434eca92c6c1b3df6668a1deb6b9c17c052694321cd0ed44c60c961decec361c09a9613bf1c9638bad3eb963bee125a3235ccdd6018602d88dd0797b91

Download Submit
C:\14c287f3e0f84e816f158b7b48\1041\LocalizedData.xml

Filesize
75KB

MD5
a4543ffb447d5b641e992a7dc912c3a0

SHA1
0e8b20569a5d5597c0d4d3c00e3bcc569c72ce11

SHA256
ddc1a5e99374a18394be27405bd77ed3e0a109c62e248e669e98a6ba24dcc036

SHA512
b90a4d3731ecb3033ef741e07e87c69b3816c16f6e8db80315942c161ce87324f540cca5d21320d494b104715162ffe3ada5ca3ce5ac245c83a12c77a749fd03

Download Submit
C:\14c287f3e0f84e816f158b7b48\1042\LocalizedData.xml

Filesize
74KB

MD5
a337649b52b713d6c38bd6a10cc0ad26

SHA1
ba63820566b4736f44f36de7a57d824cd6ff5172

SHA256
d8f34824b5b2e9c6d23e4412e8d8e88b4da03c4ab8bc32d6aa297323fa762681

SHA512
8dd0c26c5b44d63eee1cfff6b60d009eb6bc16b9b4ac92f3fcb0a35884d53e7e544d7e2439e160d3cfdb27748fdc98c7a2d2d37179199c0b484d7df25a840802

Download Submit
C:\14c287f3e0f84e816f158b7b48\1043\LocalizedData.xml

Filesize
86KB

MD5
46f24d5a0cd8d137098a049de90f2110

SHA1
9d6361a2b85cf7867b4520f90646049c0306b6ff

SHA256
2ca6d5c241ad2b28c4f66e94a18572b82732316a53b932f91042b80eb7d3e8d9

SHA512
851d431f6500bb3cf6b9ba99d666fbefa1e084fbce010b33980dd1ec525a600789f6c963d8cfa6e23443a72fb5815875a9a7dbf6c5fe24b737864a4657126d75

Download Submit
C:\14c287f3e0f84e816f158b7b48\1044\LocalizedData.xml

Filesize
85KB

MD5
f8e01bd95b60446ef26c0fb3d1846429

SHA1
1d228b6d0323774168887a744f2a035b477be8c3

SHA256
b9bb1ce8a43a9467b04e1f4ac3a291339595d9f4f25ec61390b6fe9de51764b4

SHA512
a0adfe8ea54855341fe66551fd608ea45803e8d40a454ba73d6fcb20d1f0d3bc6d8ad0411c4399813be51196fe83426e6d0e858f0b403ffe967e5436145a68fa

Download Submit
C:\14c287f3e0f84e816f158b7b48\1045\LocalizedData.xml

Filesize
88KB

MD5
a343e83aa5ef1135bda105f6b3319437

SHA1
da066b20c1d3e894b2e4417950736c7921b6345c

SHA256
e5d29b3bd972d18bafbcbf64f74f8700e98db798202d7bd05b0e8373a99cf65e

SHA512
0f1fb9b50472c7a477ecb9f7bfbc54a1d9c5fde2e50de43c3427632068acfcdc676d6dfc2cc29c6ddf98c2197c6b49e5c4a1fa35bf1896554ad09a4b8bcdbc69

Download Submit
C:\14c287f3e0f84e816f158b7b48\1046\LocalizedData.xml

Filesize
85KB

MD5
f3fb587fbbc96946d8967f595a635719

SHA1
b4865c472392812cfe2b80a35787346be3d3916b

SHA256
558d75204880fec476f57053aabf84b4e429b1ad88cd2d798d7028ed7372a1db

SHA512
8ed5dbe87574c3ae49d0705a074433b43a642ea3df684a9e1c0572f75d0bcd740ea14459dcd6221ee1be78c1f02b47b57c8830f58c8d5422773817367e1b0483

Download Submit
C:\14c287f3e0f84e816f158b7b48\1049\LocalizedData.xml

Filesize
87KB

MD5
451779feee10fda802b59a0e91e36416

SHA1
88139e965a8cee64166be9254a5aca805e9d5848

SHA256
f7afb4099194f522b91f814b4b48e3d5fc4b605e2f661977c1e532b4f932ad85

SHA512
71c5fd7867b25cd9c8af55fd505937fe862b20ca0945aed81b0661a058ad1fd7734493cb1eacef53d27f013ab4090a0a1d1e53657adaa4a87ef8bf04d1b9b680

Download Submit
C:\14c287f3e0f84e816f158b7b48\1053\LocalizedData.xml

Filesize
84KB

MD5
7f5d01d1b7fce279c7793068dee52844

SHA1
785c3300be9b6c8f8f234213bf0d719917680822

SHA256
afbdde946bf2db607913e72256e15e415561ee721a4a4962cbce86c26a7d7ce3

SHA512
9901fa9e655d1ffbada8f009cf913680ca0712aeba9bf779fbba9f87174724205a7b3192573d7d65a164a0649507a2a46318746dcbe14f3e372dfa907294532e

Download Submit
C:\14c287f3e0f84e816f158b7b48\1055\LocalizedData.xml

Filesize
84KB

MD5
73da68d1ac0a0b19d1c68c528387c390

SHA1
176e3fc0b02e0e95d77bf16e08f9594264cd1f81

SHA256
3886e5e8a8841aeb6eb520ba215e991273e303a0f101dbca4b87ede99806c607

SHA512
b074d6157c52e5ff323f6e7bd1503890dc2b6cd9b90a63a7bbd9a3977945886dec5e380b104be3e52c4fe5eba5bb409a96afc3f0adeca5bd3d6a01b7a1b6a082

Download Submit
C:\14c287f3e0f84e816f158b7b48\2052\LocalizedData.xml

Filesize
69KB

MD5
3592e35d880824fbf5ff3a3b3f9a92f9

SHA1
bc7404982cb79c63a5d0def46bea2cb03245633a

SHA256
c435c316c1a356ec724c16526f9b12209674815105102303eca51c3c7b5f392d

SHA512
19f959b6f8e7100de0467fd15d0e687403d0a3dc82dd4906f7580bc1cabf18f7a5063ec42d747045347bf61ac49b06e539695e82cd63dd0537b7e2e519352403

Download Submit
C:\14c287f3e0f84e816f158b7b48\2070\LocalizedData.xml

Filesize
87KB

MD5
da8b0c0e8bb1b8e61e59436328696e38

SHA1
e24b86cfeeaf1f9595df3ef2bb2ae1b26b08e513

SHA256
639c24ccca717a57cfd51b8ba1844afe2e2505ef9bccb6390d0a835bf6e1514f

SHA512
47bc6843d05330244ce2aae0a80e2be1e2c607cf76bffcb1b39a01075f60a80f4ede5bc48e70c354ba5bcd5cda1f8d65a38da1ca93c5f9629d863bc878d15fa2

Download Submit
C:\14c287f3e0f84e816f158b7b48\3082\LocalizedData.xml

Filesize
86KB

MD5
531e270629ac2ec628b23f0b27b68be9

SHA1
4d6aa74fa777122161961f60c6670301900d1179

SHA256
821ca98d35365d6b80c6f423403972f2f3376b0683acf4baf47abb60b6998d87

SHA512
7757260f3fab42f6328f1faef1db55332ed38f5c7b6b99b070b60233c1015f5c02b1f2dd85e826c559afeb7f184f96024dbec9fa87e224f3413c6a8bca757e36

Download Submit
C:\14c287f3e0f84e816f158b7b48\DHTMLHeader.html

Filesize
15KB

MD5
cd131d41791a543cc6f6ed1ea5bd257c

SHA1
f42a2708a0b42a13530d26515274d1fcdbfe8490

SHA256
e139af8858fe90127095ac1c4685bcd849437ef0df7c416033554703f5d864bb

SHA512
a6ee9af8f8c2c7acd58dd3c42b8d70c55202b382ffc5a93772af7bf7d7740c1162bb6d38a4307b1802294a18eb52032d410e128072af7d4f9d54f415be020c9a

Download Submit
C:\14c287f3e0f84e816f158b7b48\ParameterInfo.xml

Filesize
1.0MB

MD5
dac37d80d2a2c81fc2c8446093c40dda

SHA1
32a9b2f71498ece95dfb06bb6a6fd97034e7dfce

SHA256
07303de0269c15627538c5efdb20860fde4fccd0c004ce1d063ca6752353a3fa

SHA512
cecff11e20e6980334d3d0f1599e528ae5d54a97980caf331ec4f38b8071234073a44f48d79caaa1828f9b6341cc5c14ffa1d1c78f5a9c8e4c5bc3d38453f5d2

Download Submit
C:\14c287f3e0f84e816f158b7b48\Setup.exe

Filesize
118KB

MD5
a219f355b54cc2c40301f34671079f7b

SHA1
f5d68f79ef3954eac723bf671bc327f670e8ef75

SHA256
2b1c5c075627d587efec81bb7e6d39334975d82270f54c80f2b6362b6153003d

SHA512
88936e00b912c33e6d775a703f8059550214ecc95bba17f4634d742ffe910e031f96d5948744c36cbca543e2151f387fc402cd3ddc2899977e462e695c54a4b3

Download Submit
C:\14c287f3e0f84e816f158b7b48\Setup.exe

Filesize
118KB

MD5
a219f355b54cc2c40301f34671079f7b

SHA1
f5d68f79ef3954eac723bf671bc327f670e8ef75

SHA256
2b1c5c075627d587efec81bb7e6d39334975d82270f54c80f2b6362b6153003d

SHA512
88936e00b912c33e6d775a703f8059550214ecc95bba17f4634d742ffe910e031f96d5948744c36cbca543e2151f387fc402cd3ddc2899977e462e695c54a4b3

Download Submit
C:\14c287f3e0f84e816f158b7b48\SetupEngine.dll

Filesize
899KB

MD5
0ff0b0cb3d1923cecd359906ecfdc483

SHA1
4452be11659d76e43370e1e2553a6aa1745e12ad

SHA256
1c7335be28e808b86907b0e57c2cec320b19fa901f1f1e312e131acdffc8f8b5

SHA512
43f5ea6a654df8d934391805d56acc09f2ef59b0e667043eed5a8bd3fdb6054e04baeee5a52d4dd51cd87e5fe9a38a145c07f5a9bf664a954543fe863743c852

Download Submit
C:\14c287f3e0f84e816f158b7b48\SetupEngine.dll

Filesize
899KB

MD5
0ff0b0cb3d1923cecd359906ecfdc483

SHA1
4452be11659d76e43370e1e2553a6aa1745e12ad

SHA256
1c7335be28e808b86907b0e57c2cec320b19fa901f1f1e312e131acdffc8f8b5

SHA512
43f5ea6a654df8d934391805d56acc09f2ef59b0e667043eed5a8bd3fdb6054e04baeee5a52d4dd51cd87e5fe9a38a145c07f5a9bf664a954543fe863743c852

Download Submit
C:\14c287f3e0f84e816f158b7b48\SetupUi.dll

Filesize
341KB

MD5
993abbe7b80f22541cd6b7a3bf69bb75

SHA1
95746e45bcd0089422314dcafb9d7e257c0e1d6f

SHA256
34b2b800528d3ba8d8b233325cf2e125182dcd0fd75dc4fa2dec20801211c012

SHA512
b8aec0c14d5271b782c7fbf3226c0127a33c71b39c8222ccc8721c8fecb506144d528757cd683b8cad1bd7213d2bd52fd23bb664157fccc1c29c6f5fe02d9591

Download Submit
C:\14c287f3e0f84e816f158b7b48\SetupUi.dll

Filesize
341KB

MD5
993abbe7b80f22541cd6b7a3bf69bb75

SHA1
95746e45bcd0089422314dcafb9d7e257c0e1d6f

SHA256
34b2b800528d3ba8d8b233325cf2e125182dcd0fd75dc4fa2dec20801211c012

SHA512
b8aec0c14d5271b782c7fbf3226c0127a33c71b39c8222ccc8721c8fecb506144d528757cd683b8cad1bd7213d2bd52fd23bb664157fccc1c29c6f5fe02d9591

Download Submit
C:\14c287f3e0f84e816f158b7b48\SetupUi.xsd

Filesize
31KB

MD5
a9f6a028e93f3f6822eb900ec3fda7ad

SHA1
8ff2e8f36d690a687233dbd2e72d98e16e7ef249

SHA256
aaf8cb1a9af89d250cbc0893a172e2c406043b1f81a211cb93604f165b051848

SHA512
1c51392c334aea17a25b20390cd4e7e99aa6373e2c2b97e7304cf7ec1a16679051a41e124c7bc890b02b890d4044b576b666ef50d06671f7636e4701970e8ddc

Download Submit
C:\14c287f3e0f84e816f158b7b48\SplashScreen.bmp

Filesize
117KB

MD5
bc32088bfaa1c76ba4b56639a2dec592

SHA1
84b47aa37bda0f4cd196bd5f4bd6926a594c5f82

SHA256
b05141dbc71669a7872a8e735e5e43a7f9713d4363b7a97543e1e05dcd7470a7

SHA512
4708015aa57f1225d928bfac08ed835d31fd7bdf2c0420979fd7d0311779d78c392412e8353a401c1aa1885568174f6b9a1e02b863095fa491b81780d99d0830

Download Submit
C:\14c287f3e0f84e816f158b7b48\Strings.xml

Filesize
13KB

MD5
8a28b474f4849bee7354ba4c74087cea

SHA1
c17514dfc33dd14f57ff8660eb7b75af9b2b37b0

SHA256
2a7a44fb25476886617a1ec294a20a37552fd0824907f5284fade3e496ed609b

SHA512
a7927700d8050623bc5c761b215a97534c2c260fcab68469b7a61c85e2dff22ed9cf57e7cb5a6c8886422abe7ac89b5c71e569741db74daa2dcb4152f14c2369

Download Submit
C:\14c287f3e0f84e816f158b7b48\UiInfo.xml

Filesize
63KB

MD5
c99059acb88a8b651d7ab25e4047a52d

SHA1
45114125699fa472d54bc4c45c881667c117e5d4

SHA256
b879f9bc5b79349fa7b0bdbe63167be399c5278454c96773885bd70fbfe7c81d

SHA512
b23a7051f94d72d5a1a0914107e5c2be46c0ddee7ca510167065b55e2d1cb25f81927467370700b1cc7449348d152e9562566de501f3ea5673a2072248572e3b

Download Submit
C:\14c287f3e0f84e816f158b7b48\graphics\print.ico

Filesize
123KB

MD5
d39bad9dda7b91613cb29b6bd55f0901

SHA1
6d079df41e31fbc836922c19c5be1a7fc38ac54e

SHA256
d80ffeb020927f047c11fc4d9f34f985e0c7e5dfea9fb23f2bc134874070e4e6

SHA512
fad8cb2b9007a7240421fbc5d621c3092d742417c60e8bb248e2baa698dcade7ca54b24452936c99232436d92876e9184eaf79d748c96aa1fe8b29b0e384eb82

Download Submit
C:\14c287f3e0f84e816f158b7b48\graphics\save.ico

Filesize
123KB

MD5
c66bbe8f84496ef85f7af6bed5212cec

SHA1
1e4eab9cc728916a8b1c508f5ac8ae38bb4e7bf1

SHA256
1372c7f132595ddad210c617e44fedff7a990a9e8974cc534ca80d897dd15abd

SHA512
5dabf65ec026d8884e1d80dcdacb848c1043ef62c9ebd919136794b23be0deb3f7f1acdff5a4b25a53424772b32bd6f91ba1bd8c5cf686c41477dd65cb478187

Download Submit
C:\14c287f3e0f84e816f158b7b48\graphics\setup.ico

Filesize
123KB

MD5
6125f32aa97772afdff2649bd403419b

SHA1
d84da82373b599aed496e0d18901e3affb6cfaca

SHA256
a0c7b4b17a69775e1d94123dfceec824744901d55b463ba9dca9301088f12ea5

SHA512
c4bdcd72fa4f2571c505fdb0adc69f7911012b6bdeb422dca64f79f7cc1286142e51b8d03b410735cd2bd7bc7c044c231a3a31775c8e971270beb4763247850f

Download Submit
C:\14c287f3e0f84e816f158b7b48\graphics\stop.ico

Filesize
185KB

MD5
7d1bccce4f2ee7c824c6304c4a2f9736

SHA1
2c21bf8281ac211759b1d48c6b1217dd6ddfb870

SHA256
bfb0332df9fa20dea30f0db53ceaa389df2722fd1acf37f40af954237717532d

SHA512
16f9bf72b2ddc2178a6f1b439dedabe36a82c9293e0e64cfaccbf5297786d33025a5e15aa3c4dc00b878b53fe032f0b7ed3dee476d288195fb3f929037bdcdbe

Download Submit
C:\14c287f3e0f84e816f158b7b48\sqmapi.dll

Filesize
221KB

MD5
6404765deb80c2d8986f60dce505915b

SHA1
e40e18837c7d3e5f379c4faef19733d81367e98f

SHA256
b236253e9ecb1e377643ae5f91c0a429b91c9b30cca1751a7bc4403ea6d94120

SHA512
a5ff302f38020b31525111206d2f5db2d6a9828c70ef0b485f660f122a30ce7028b5a160dd5f5fbcccb5b59698c8df7f2e15fdf19619c82f4dec8d901b7548ba

Download Submit
C:\14c287f3e0f84e816f158b7b48\sqmapi.dll

Filesize
221KB

MD5
6404765deb80c2d8986f60dce505915b

SHA1
e40e18837c7d3e5f379c4faef19733d81367e98f

SHA256
b236253e9ecb1e377643ae5f91c0a429b91c9b30cca1751a7bc4403ea6d94120

SHA512
a5ff302f38020b31525111206d2f5db2d6a9828c70ef0b485f660f122a30ce7028b5a160dd5f5fbcccb5b59698c8df7f2e15fdf19619c82f4dec8d901b7548ba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3d48d481-87e5-4d84-b4fe-23556e490602.tmp

Filesize
4KB

MD5
9742c5b525fe6ca70b46289577ddd337

SHA1
54e96f50a4e5af3afbb5551cd9711c4ff388256a

SHA256
9f0045973d10fb558a93638a027069feeaadeef0363a0781500b2b65689c6059

SHA512
03f6d3bc98e7bfcc9a8845dcedfb1efde1b5c987310b0687af43b2c5171edd381ebc67723dec5cd3a93cf47922b25a217a03af65400a206656ac7402b38ab7aa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\638bb06e-bcc7-4e0e-86ca-793c4a2e06ff.tmp

Filesize
4KB

MD5
4fcee02d342a291c6f58e7c3dded924e

SHA1
8977879122baf0ff2eb6193f459243603b97f46c

SHA256
945f0336efeb8301589cfb746861a53903b338f1fdeb291861a23a807ef6183d

SHA512
d4de6c2dc69e7713302871f95ac6336c861b7588e3346579808329b9097fa13ce57806e34940ac87a9c7843e43f8d6a541e127206f16394c25c81daf5bc457c2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9f17be90-a7f6-4116-9c63-b8742c4c3c3c.tmp

Filesize
4KB

MD5
2d5a67a628ab45cec7bafd41b942dbb8

SHA1
20a17137031ff485b99d229ee694d178731a7e35

SHA256
21b7f15c350c84c609b56cd8b34fc907cc3fe6733aa91bcb9b4847f0b124bd4e

SHA512
86c58e92ba328d1d7d784b84163391e6e8e4ab7e471d3b41c1e916bdba76169043b2077f1499a13f6a7b2b27ef52b7ff2fd30ccdecb216e7b822e20eebd3d1a5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000011

Filesize
1.4MB

MD5
3cc6eb65f108607b6651aa6e64693681

SHA1
060be6be4dca7ad35d2176c61d87db47e45f0c4c

SHA256
38601496e0736437add795cf4e5f93265e799a7a3ce83d52a0a29df3055968e2

SHA512
623e83f63abd3ec1e83e06ce8323a9bfa390445884f931aca4c9d9a028279f0a8e975db01a806617c7569a04fc479c03b85c6fd5a4bdd94cc13b971b33b49da0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
ded0f431069ea8065a8b133d67a72e66

SHA1
f73651b1f6a2349edaf49383a31743c8131b3d51

SHA256
ec1c3735b01fbbff4f0ca9d940034536dd61a0535b158c66c0780fe1285218b6

SHA512
16cb7c5b4af11a967f66c266ab272e548bd8283f2ff00c810d9a2b0bc63130ad9b18383d636eb902cbedbbe11e2011ad923377ae1db39455abad6d68a6bb472a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
a14a42f9108346a5294887a16851bda2

SHA1
0ad37ff84a37f275deb5f8171ed49f32e387eef6

SHA256
99d708578ded89f38ca2218fe4c566246a96f78606d597efe5529237ac0d7293

SHA512
1d679090baaf632ee22d8530fabdfcb7ad0e583f09e7ce127203cb29a3dd21398f217d77c9d8c78267540aa551d2994b1c156835c7e732e81c1d484f6982d7d7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
683204188e53b562662cbcc07a6e7f15

SHA1
6f58139f29a04f742707f08f59af20d1618ce96d

SHA256
0c5ae9f515f40fd4254ab30c1a559ec314c6c9960c1506f69b18bb979877c9bb

SHA512
ddcdd277002b655d0208e8bbe55bc490680800f8970dce684e1501c5fd2b986f21c8b91c1fb92129a57f48179ee754006bb7cb6bca340795c3d5ea5dee039096

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
706B

MD5
68653f7aec4893c363fd62324e712933

SHA1
955a952004e648724a703b50d2acbc3186352fd7

SHA256
82280c5af1788edd4c64f3b4281c41c04da2edb45d2c48fb177ef4f545e28c01

SHA512
a54b350b871ba8c64a691dd3a6e1d969293c87f4617239536d90c33c24b3eef4ceeb0452c738354b492ba433397a2e4568e3e21f1f4167f1132242c2e0c44d7f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
6289f8df436ec9f15659c78f20b74487

SHA1
8dc871842db190982554ba925f695bfbadfc01cb

SHA256
c6263f590c3fe9ec56d5344e896fec7871c7e0c11cfc3bc2f6e4cb55319a299a

SHA512
69c673059ea4f7f8b12f4ec3492a5c88e9800aa10fe87bbb97e8fc8378493f5bb5e3c2ce616d447fc77758aefbf8677c975ab2983efd2741d9bcedb3e4fa588a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
e39640e1963adbdc40a28efd008385e7

SHA1
5e89f697904689979e4df361b47da689cbf1c967

SHA256
c639daafdabd08cf130296538030521bee3a98ad76a36037fe65dc0e78763df2

SHA512
c965e442284ab1c5c1154409307be318b14746dfb6e6edb6a7de97d38ae1b92c34500ee21a020c0be5e558eb59746afa990f9ebf4144bbb3e3f9576c99772bfa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
ae60a68349b29c6d3bf71c83e8ccdc53

SHA1
ffa2bedcb654d468537bddb6d4f2bfe7afe7dd47

SHA256
228ce4680be78dd73e9ee7ecebd89884c8c58f933b044cae3a78943887f32375

SHA512
590782dcf8a08e5522f56cc3a5e2bffee602e9d6559ff6a6d41b8521386caca0aef04d15bcdcd52297da7553b730d4d7e1b99bc55ec4ba1d50d63c8b16d3a0cb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
ce0930527cb2460f3a1c5fdf20cca96c

SHA1
0627ef53a0c2e8c4e73edb7374080159942b3d60

SHA256
1322c60b4d7e27251fc298dad589f89e63d83d8cfab6c76c4051dd14f12c50c0

SHA512
dd645bbfe0a6b4f8fa2048b4a7be38c27df235b94b9f24259f556b2076698e2decb1727018bfdec36ca561e68b363c0a4aabaead6ea5bc75880ee089cf01b853

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
5ec944ff3050457933731a98f95cee57

SHA1
12d54626a02cdf6b216c18f39b08c8c0cf57c87d

SHA256
d564a97653b5cf0982531a10c7c0518713fd24dc7a8af726495fd6d9abb5e11f

SHA512
5e0c24bd2abc13d67e934e77708110dfd1872f8bd6aa71a83a420f613dc4330fc938da20df93b5415ad1e93aa6936b1dc89c7ace138c6557fb30d918714a98ec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
ade33d1b610da8ab150ba75922c60448

SHA1
4f28c9b0496bae197e7035189b19f36a2232e176

SHA256
97d6e31096bfa2d0648a66c24d8a53b69c0806418a4c3cd0fb8ac29e516da045

SHA512
b33c49597397ceda8c576c4b24d4cc2b7239029447b9789f97436d3cb78c2a7acedca7b945bd2754ee2648308e0df2507833248562b843acc2a94bdfc5353a76

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
a0ff25272ecc5b00371fa4c891658e38

SHA1
f0924ec71423b7eba1fac5143469902400c440b1

SHA256
9ddfa5ef144746fa6212e3411960ab266f9fac4ea73e58892f9fda86bab7f7ca

SHA512
3c90941704272d08e890dfe524dd86907854e58b50c557b9f4acd8629cab2ff4878817df90cd40a18b9c96df41597836b1d59430229eb5c0570c0ab620411f07

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
3950dc34cac7db6a06a75e108b394c3c

SHA1
dd4b35578ad18ccb1dc72dca62a570b54be6a8f7

SHA256
030f7a0fdfce90e5117408791f80341fb12a97dc00ee21361ea684705d2a97e2

SHA512
1c98f59953dd35faf391c5f5b68a57620f9952ea959611f8ca168dedeedc611e0ec366b1d1c35792110ac1a884080afdee6ab0be3c5c20d5b540052d1582bc55

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
05f827958875300335d66eeecd8688c0

SHA1
ba4d9ae27769bbe753f9c618c642cc5100dbc72f

SHA256
27ec2eb8c91418e767153303b8388a94cba2b2808c79fb4a3ee6449bb8881f0a

SHA512
b655ebbdf411f82e864edf64e7f7dccb354e445feb2b0e062a689551d28c76a7dadaeb3349d6c8c99966ddd7b1da1747903f2dd0a6f7780fed311a220c38b472

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
0cb6920e7fb5a8d63fae2ff2a6c8bea3

SHA1
b25ae4db8c28e83b47e3518f04376119795054ff

SHA256
5946370d15732b6125b88dbb4e3eb6e0c7bf3693f2d21a53cc59d5edc5f5ee4f

SHA512
744abbccce642618d0c60b40956cd5c3493d0d453b3903286964b669d2d9dc6d70ab0e34cc2ac981b6623858cff98b3e1f86296cec673f0e128d58903bbe84d9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
fa8b7da981fcf27d35cfccc05feb0cc0

SHA1
da3cbf3b386bdefe3989065788f38f1b18743c8c

SHA256
8d91093a41f08e2fea6f43ed77554ed6204f210676e6ff6a2005d63549c9151f

SHA512
60ddd00d75b343a516492f072add22c72051bf9d45a139c40bf7a125675cda3d20d351f38ca20bf95c203b5636fc601538c3c69d014453e874c444abcda92e94

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
0a81d50943dc1151185e8d6a1d2686f0

SHA1
fdb933979f024a579696181dcacd44f60c7453fa

SHA256
91631ef060ea3d899f031f60f6f0b5a39038bab3f5061aeb5e390f6907d4037a

SHA512
5bbb005ffa3aa2ada35055d56d63de4a3b2d14967e8356be3c78f09b962200f2b7051b4f9a83cc870cf934aae512029574c4f4595af6ed1590349e6ae5e7fb44

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
6676d3e42bbde6a87ea927dc15486fca

SHA1
ed9cf95b50f7d62cab5e66c9589ca766bad0c186

SHA256
01da197acd2b2a85a694b18968869c2b91926805b25b9c006cf1892897dbe4b8

SHA512
470b494f55e7b0b12eece7483a5c07435b6edba63e0a24084be0c3b5e9fdd2251ec77e387cb6b7cc7058e9cbd2e13b1382a7e4102f19227e6b1c91dc22005fdb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
d8ddd64882ae18f073e59800972960b4

SHA1
59c64ab17611b348e68bd98ba0570bc11cf2e229

SHA256
808d8b36ab9154b0d82c2801e8e457a2012d4959443f8f1cd25cff6525ae1791

SHA512
6bd37ea8bde456840109011bbc0c89074e47bf749b6aa8e0b7e57705848e8e2be41309814f11d6bfb96ee8bd95e627d5aeacbbef82cea2df4fd837d04454c9d4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
ed7757ab47ea6b3c4ae009e594dcf439

SHA1
41f576e5deed208b8008cb11433f5843a5c03e1e

SHA256
a6d0d8cd9538503aeeca9a32792311968c03a95640dfab03190d3d500d1bf3ab

SHA512
3056e6914e329e54bb2939c92b8a1c332c53549b559e7a727a5362276bc78a318baf5e864c3f3b63ff192d030527ab6ccdc478280f71cdb4c69949f3f1add737

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
d78447ab6d4bc4262122389942e2662c

SHA1
bb3f964db9f036a68a9d9e649eb4162e9a2e69a2

SHA256
1a81f2cd44f8bcdcee5d88402aaba0656603859f0ded1c9353d85beaba80bb0f

SHA512
32b8523f7d20a484958c585e1de81e767d422c7832de14c1cc6ce93fd2a716a441d4c04900c83b20edceb3a237e2c08ab4b8702e1d278bdea6c3f007519409d6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
e19a5497302aa0f7610614693fad7857

SHA1
967078f3c477298ede2ba916bb2ee3dcdc3ae7b7

SHA256
e93afb2346cdfcf014085989e9943416fe8f27f96c6a3df5a3643f3051e689d4

SHA512
3a076815d40c1b7c84b856b5b91a753050b56edbe4d2f704e969963f6a11591a48eed7180efee4abfe262fa1ca1752d8fb093b2f3434369e381faea8262beb0a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
385cbe3852dd61c97bdcc63a79649bed

SHA1
24901dfdb5a89527f98b438a2b210649ebf04f64

SHA256
141db891e4a80e1723e4cf22600304ca7447419cdabb890a3abe91d1865f4482

SHA512
afbc93483abc66da00c8940b06ff1aab44fc47a9d69c01542cba93d9c3d1d7b7bfb49182544041c90e9fff1cbcdf74cb89e0641753c9434ab745d5e96c09a769

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
12dd4ba385539940022f989abe93af9b

SHA1
71422e5c00f43a3448c56a0f27fa7ed0edd64991

SHA256
d38bf2c6b7193f01f588bbe469e6a69182edb31a998503a5aa739550b8d4fc33

SHA512
59f182277b378bfb9c019567ff10c6893c8120c97f85842ca51286a5409f492b8319ef63adbc84725b5330af22bf546b708147d09ddcad268b6b4de935c74244

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
65155b46822289b53ab302b099419b6d

SHA1
9cf8a1cf08fce57f7c7522410857ebec2c2a7a7f

SHA256
82283084b3124f088d0f33dfd17b8941c46b75f74bee9d3dfc8dc1e37f843ab7

SHA512
f576c64102abd0e4e9b4eaad02523a92d75a9a753278486d2ebc1906997b2499b79999d0276693221607858d4e4d1caadba685ef96967206f3938d8e00b9922d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
114KB

MD5
512810723e4235ad13141c19c9b99598

SHA1
51c5c09f21fe4f22cf1fd7a5db714ee93942e143

SHA256
e67d2270940e7dc7982d3358900152c2635cd3d9069fe8d2ecc1112fbba02e65

SHA512
84fe46930a56e07ae3c5e9443e243fd6f58f0da9144e9f76ea3744e15ea9693c7110b43e0d9e21a12135900dab4e5c208d9773cb3eb56e8571abbac70257866e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

Filesize
114KB

MD5
f8bddf193292aaef73221ab13802fc10

SHA1
443d58a7e4d3b4e0a23c320db78cce9cbf2faef6

SHA256
e6f75dfb3def8ebb159e8439bb0293f87c8aba9a5cb40be03e1f2499ef8fde56

SHA512
b92724c7dee84c5f4f9dd49db87155d101a21cacc9b694d8b18964106f22ae79beffe0df78b624c6e037f3d3f2f0c7600a3e9dad811d053a730ff47ff4b612e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe578146.TMP

Filesize
110KB

MD5
60cda52621df5de7e35721ea348f15db

SHA1
2dd856849b9e3f121adc3c0664e6dddfd17f377b

SHA256
c94ca28c501d75f9a6b3519301e01007d4b2d035ba9c07caba56482515be09ba

SHA512
ecdd84feba1f35afde1da378a46ce78016bb0dece4b76155604c04ca7b5406be856d0b85ad9978eeecfb33d30da2dda182f44dc59f0de24299b7504efa3d578d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\c2c1fa0b-ba40-4ea0-86a1-0346ad0cad60.tmp

Filesize
201KB

MD5
0c25186137e22a779526d863f8b3d534

SHA1
a8880f37ca0b6cc04da67c04057d55f60b42dbe2

SHA256
5b8ccb4a37d81b3026ae7778125efb42f1c040e2f542f9b53b56824f7d6153bd

SHA512
8285b94345ff5173bbc9c0ea1786fea391581feb0602333e6a32631bf27df71f3696aaaa77eadad67d26514e022393476c78ef0b949731698daa2629155287d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Eihb.exe

Filesize
118KB

MD5
677073949945ca09fe971682561c5f11

SHA1
cb33238550faa82cb5d3b5e4116a8c721a4fc96c

SHA256
571d22f4659932c89344baf33e0e53dcb790fa9cb196ad7a937ce17f567f5062

SHA512
006c596edb2c6cef589319917c70531e0672cd8831a4d6852c0641e9cc9a90d351f687884da67a02055706c334e94b68a17c8a0cf9f6041b633f8f85cd9185f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\HFI1AFB.tmp.html

Filesize
15KB

MD5
cd131d41791a543cc6f6ed1ea5bd257c

SHA1
f42a2708a0b42a13530d26515274d1fcdbfe8490

SHA256
e139af8858fe90127095ac1c4685bcd849437ef0df7c416033554703f5d864bb

SHA512
a6ee9af8f8c2c7acd58dd3c42b8d70c55202b382ffc5a93772af7bf7d7740c1162bb6d38a4307b1802294a18eb52032d410e128072af7d4f9d54f415be020c9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Rarqxqlarwy.exe

Filesize
2.2MB

MD5
a3ec05d5872f45528bbd05aeecf0a4ba

SHA1
68486279c63457b0579d86cd44dd65279f22d36f

SHA256
d4797b2e4957c9041ba32454657f5d9a457851c6b5845a57e0e5397707e7773e

SHA512
b96b582bb26cb40dbb2a0709a6c88acd87242d0607d548473e3023ffa0a6c9348922a98a4948f105ea0b8224a3930af1e698c6cee3c36ca6a83df6d20c868e8e

Download Submit
C:\Users\Admin\Downloads\CraxsRAT-license\CraxsRAT-Linuxndroid\MetroSet UI.dll

Filesize
444KB

MD5
d99a97de55b2561e57135433b44bb786

SHA1
ab588b8d36683b52adcb32c03a9859b884838f29

SHA256
6288e559b0f34d56ab4601ffb2ba2289001c77cf7351d135dd93915034c56bba

SHA512
7ef95cb161265fcf110ba843fe3af5e6cf6d47465e17a10c742256bebd91c128df2cfa7d21696d716bfa861c952d6fad445912f8cca9da9cb03d780211b0545c

Download Submit
C:\Users\Admin\Downloads\CraxsRAT-license\CraxsRAT-Linuxndroid\WinMM.Net.dll

Filesize
43KB

MD5
d4b80052c7b4093e10ce1f40ce74f707

SHA1
2494a38f1c0d3a0aa9b31cf0650337cacc655697

SHA256
59e2ac1b79840274bdfcef412a10058654e42f4285d732d1487e65e60ffbfb46

SHA512
3813b81f741ae3adb07ae370e817597ed2803680841ccc7549babb727910c7bff4f8450670d0ca19a0d09e06f133a1aaefecf5b5620e1b0bdb6bcd409982c450

Download Submit
C:\Users\Admin\Downloads\CraxsRAT-license\CraxsRAT-Linuxndroid\res\GeoIP\Flags\ID.ico

Filesize
33KB

MD5
5d67de2e110c919d9086c0a5177512f1

SHA1
2b94eda8410aaab46194effa2bb940dd4c7b1300

SHA256
dc1ff53aff377d325bff9615753ee180e57054739b4e076d34250830f90a9573

SHA512
2de6c70c2060c9c047bb4d5133eda3fcd47571396bbc3b36ae11caa9f14c313ccd0536ff1e74ec8f81ca0b1898153864fe1c8923fa149dab08305c5bc4d699fd

Download Submit
C:\Users\Admin\Downloads\CraxsRAT-license\CraxsRAT-Linuxndroid\res\Icons\Apps\health.png

Filesize
7KB

MD5
32bd051749a0fc05e1bb83707fb379ef

SHA1
479ef7feba3b01dc6aa39817104ab9f78ba6451c

SHA256
515a7cae5767ed438b9112de05d90bd36568cfa68d5284ce648cff45400fe0e0

SHA512
3a80f3f0890337ef0294dd4a1b473a136b732438dfb125a3fb80103451b471919621952a21be4b0cbc3fbc7b479545711c9a5dc498121de9b7fde0f77128685a

Download Submit
C:\Users\Admin\Downloads\CraxsRAT-license\CraxsRAT-Linuxndroid\res\Icons\Apps\s_translator.png

Filesize
7KB

MD5
bc33c93efd4900d799deb3cd6a195b42

SHA1
18a3527e1e4382e83fe50b470d8cc393d695542b

SHA256
5506ccae41f78fa556d449c2cf3aa95e6caeaecdce847eda5289037aa33c1824

SHA512
164439b404d354cfefdf55aea30ddc28c6a0ff4cdbcf3986b003eed0fffd35f9740ad7add000363e05b774ca80897848e3ef68248897a58cb0f5282e1b701f15

Download Submit
C:\Users\Admin\Downloads\CraxsRAT-license\CraxsRAT-Linuxndroid\res\Icons\FillEllipse\Account.png

Filesize
698B

MD5
39e0ecdb310ee1ddb101bca1823d67ee

SHA1
125750d6fb8acd2e2fc9095000beeb7a7ac042a6

SHA256
927ac84ce42ea8dffb38d29807ebc2c0596ab845c38d75f0e0f448eaf915e843

SHA512
c27a884fc5571fa22c77253a3a04821d766b54fd2847f325d66b509b779398fb1c00b3a903ddd60aa3952a7ac049cf764f340ce11c0a3a53de6b8385411bdb68

Download Submit
C:\Users\Admin\Downloads\Cypher RAT 2023\Tools\Tools\MYSTUB.apk

Filesize
666KB

MD5
745586de8a81d9c2ecb035782602ede6

SHA1
1c511be15bd6a825a6cb6e27688d4bf90c31a4c3

SHA256
cbe423e59f30038b390ad4064de41ff8e5b53adb45e287f321842eb6cf7f0477

SHA512
5dec17406a19ec279d9576facfdd442bfe657e634fd18e0d0f47f67bed623e2155cecbda315074fa29ea4104e0771fe5085e8b2665a79456445f212c1c30f7fc

Download Submit
C:\Users\Admin\Downloads\Cypher-Rat Latest Paid (3)\Cypher-Rat Latest Paid\Cypher Source + Rat\Cypher-Rat-Source-Code-main\Cypher-Rat-Source-Code-main\AngelAndroid\Froms\Build.resx

Filesize
8KB

MD5
95a30de00ea71a7e06208e187c4c58dd

SHA1
d8f99ba2b8435561f57cab10bbf9980960665ed0

SHA256
8ae83e85fd0bcec67e652fa8956e7a7feb2730efeaa4cc649e3a5640592b7feb

SHA512
9c39086e6b23bdc864ae095ac6f53cfb59c9bfcd7781df86eb9af9d9bfaf2f25c37902f9cebad00c5fd12b38c27c9dbd849d77c9bc1ae4d346519f92e419087c

Download Submit
C:\Users\Admin\Downloads\Cypher-Rat Latest Paid (3)\Cypher-Rat Latest Paid\Cypher Source + Rat\Cypher-Rat-Source-Code-main\Cypher-Rat-Source-Code-main\AngelAndroid\Froms\CallPhone.resx

Filesize
6KB

MD5
06e4f22f20823cb3af87670e165f69e4

SHA1
a1f1f175c309f6e6347af99e375b45dc414eb7c3

SHA256
96c057a0177d86d00a25ccb3ae0b73f5a9dbbe231f4d2dc9f1538d79fdd7a563

SHA512
ccfbca2e783a6b5c78a733e820ed5ca3ec56cff5b77b8776c5d60bb06f3453432b0a1bfe55f857131483a9454cff49c873b7f03f2871e798afa5424b91d1190b

Download Submit
C:\Users\Admin\Downloads\Cypher-Rat Latest Paid (3)\Cypher-Rat Latest Paid\Cypher Source + Rat\Cypher-Rat-Source-Code-main\Cypher-Rat-Source-Code-main\AngelAndroid\Froms\ClipboardManager.resx

Filesize
5KB

MD5
a1758c8fbeb2e879b721a975e984a4f5

SHA1
ca19d3d24aea8e548f125cabdd6ba58072fa51f6

SHA256
b0a58a78a54fec91f161e24dbb721f98a5f9b3cf1d4f57a3c984d555ad6ef801

SHA512
dc69245f57dbd9972cb17d9f4fe69891212dc37a627dd3d9d5caafc394ede044a5bc44f7fec03a56f26d684d9d06694b3e9c30923ab5de046dbf5f077a9685d2

Download Submit
C:\Users\Admin\Downloads\Cypher-Rat Latest Paid (3)\Cypher-Rat Latest Paid\Cypher Source + Rat\Cypher-Rat-Source-Code-main\Cypher-Rat-Source-Code-main\AngelAndroid\obj\Debug\AngelAndroid_v2.Applications.resources

Filesize
180B

MD5
cd7dbc7abeda9893ce25793744443958

SHA1
dbbbbe2694d4b9b990881f279b4313574dbeac9b

SHA256
e13ed2c59366d0eea74863fd71a81f0cb977cce1edfde304fc538690a4f6ac89

SHA512
e880f131ff460384940248ab2ecd97189ae0b7169fe5246440dfbce32f295cbd7697ce2ee65b434a0e40be91b91c21b2c14b1f446b2b1650d0a5d94c0d4f37ef

Download Submit
C:\Users\Admin\Downloads\Cypher-Rat Latest Paid (3)\Cypher-Rat Latest Paid\Cypher Source + Rat\Cypher-Rat-Source-Code-main\Cypher-Rat-Source-Code-main\Cypher Apk Jector\CypherJector\CypherJector\Form1.resx

Filesize
183KB

MD5
cc2fdf43ffe1e453a76219990990aad1

SHA1
c3f68e5003eb141d0aae457f168d401966c55157

SHA256
4ddc53249408f9ebe3b3d72401c0ea1e2afb70390d033d684c7e3dbeb8b37d26

SHA512
259639044e406c4783ac267c4eeaadc7cc4ba73d2306e1c488d03535e98f116b35ffe4d1aa08de2b8724a4c86454bdb58a0647cdcc9b6e0da9a13bd129725e08

Download Submit
C:\Users\Admin\Downloads\Cypher-Rat Latest Paid (3)\Cypher-Rat Latest Paid\Cypher Source + Rat\Cypher-Rat-Source-Code-main\Cypher-Rat-Source-Code-main\Cypher Apk Jector\CypherJector\CypherJector\cylogo.ico

Filesize
151KB

MD5
d99bac6dfc1f77820848530fb84e53e9

SHA1
7318cc8bf4994d0a2669980b94519f706516b1b7

SHA256
5a2969f6766fb7d03f5da14a06052c86da109984291a1c37d8c6628a9bc10165

SHA512
c531970f604a127bf000ea4699cc94e189cf1f9755fd1aa10d5a2a8065912d8a6e7864910ef20bac32d339f2a881bfe7ec29f592743eacc20d26662a71bf852b

Download Submit
C:\Users\Admin\Downloads\Cypher-Rat Latest Paid (3)\Cypher-Rat Latest Paid\Cypher Source + Rat\Cypher-Rat-Source-Code-main\Cypher-Rat-Source-Code-main\Cypher Apk Jector\CypherJector\CypherJector\obj\Release\Kraken Jector.vbproj.CoreCompileInputs.cache

Filesize
41B

MD5
7ffc43e8ff389dddb13886d708d834cc

SHA1
e8d4841e23cc42279ffca19f8843f333fd73c4ff

SHA256
4b746f6abdc815efddb3ae19da2da126f166acadd960157513e76979a4d5ec75

SHA512
81bcf4adbd97441f52c19c225331ab9559b7e71c3ad8f1647ef26178679de3c47198077b2f205da125dd00f7393a6feebf75dba25b5a22add13f40b0bd09d396

Download Submit
C:\Users\Admin\Downloads\Cypher-Rat Latest Paid (3)\Cypher-Rat Latest Paid\Cypher Source + Rat\Cypher-Rat-Source-Code-main\Cypher-Rat-Source-Code-main\PATCH7\.gradle\6.1.1\fileHashes\resourceHashesCache.bin

Filesize
18KB

MD5
0a910a7204474ae7ec0e0dbf634694c9

SHA1
3c3af70828c9895aa70323bfdd0257438825e9ef

SHA256
5bf9768172ce60cd85abb6a6c71f6c80b57dc31e7a62e93da13424a5b75c2f70

SHA512
ae968974601b387faf9ce06ea0bc938cbf186dc6bb732e380df57fb55e4dfc470afdf6fdad131eda626d4281668a5b969b2bb57a09922f5e4078a569dd2aff38

Download Submit
C:\Users\Admin\Downloads\Cypher-Rat Latest Paid (3)\Cypher-Rat Latest Paid\Cypher Source + Rat\Cypher-Rat-Source-Code-main\Cypher-Rat-Source-Code-main\PATCH7\app\build\intermediates\annotation_processor_list\payloadRelease\annotationProcessors.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\Downloads\Cypher-Rat Latest Paid (3)\Cypher-Rat Latest Paid\Cypher Source + Rat\Cypher-Rat-Source-Code-main\Cypher-Rat-Source-Code-main\PATCH7\app\build\intermediates\incremental\mergePayloadDebugResources\merged.dir\values-ar\values-ar.xml

Filesize
164B

MD5
6b9ba346bcbc3c134117cf30de3a6386

SHA1
2840f3882fa678c27a04e8b9a6f701bb5dcd49b1

SHA256
78450ff810fd18f4086ea3cebde3d191f1fb99444e1ad0edb774380a0f2bd6be

SHA512
7b549171e1dcf7fff059ab1f8fe6c806db7b58479c0bc9b703ac55869016c821078979feffc9c66379574f4caf3b166dd96b35d59b9f6295c25a2cbbee1f8bff

Download Submit
C:\Users\Admin\Downloads\Cypher-Rat Latest Paid (3)\Cypher-Rat Latest Paid\Cypher Source + Rat\Cypher-Rat-Source-Code-main\Cypher-Rat-Source-Code-main\PATCH7\app\build\intermediates\incremental\payloadRelease-mergeJavaRes\zip-cache\27p2I8RStblIuHDd3Xd5OL6fn3k=

Filesize
118KB

MD5
474163b82e58efd2ea85df497aba1802

SHA1
bde0667d7414c16ed62d3cfe993cff7f9d732373

SHA256
2cafbe356f71c208013d021f32943904798cd6459e5107f9fe27000eb5bc2aef

SHA512
68a70ae988e67cfa75de59c265c3550cd6e25ed8bd7cb76941134d93cbac020f5d0c9949adcc740fd7e7f9495b323448151352b7f294a36c384fafc1a3a1506d

Download Submit
C:\Users\Admin\Downloads\Cypher-Rat Latest Paid (3)\Cypher-Rat Latest Paid\Cypher Source + Rat\Cypher-Rat-Source-Code-main\Cypher-Rat-Source-Code-main\PATCH7\app\build\intermediates\incremental\payloadRelease-mergeJavaRes\zip-cache\5_Znqsk2EA10O45oyxkdz9Zdi5U=

Filesize
41KB

MD5
b35a709b47bd6bc80820da530717f56e

SHA1
c1bcdade4d3cc2836130424a3f3e4182c666a745

SHA256
93c258c8a09f531a267653829742c0f8f6da0e348b11cb8655b0855628f2d4f0

SHA512
4731af41831444c7aa7bc6616006b9f2e6b0f154be078c23d58e8270958b7133309cc38066cee8ec13d79ba772a7b78a062e75baa8e765fa50452ff27e23e060

Download Submit
C:\Users\Admin\Downloads\Cypher-Rat Latest Paid (3)\Cypher-Rat Latest Paid\Cypher Source + Rat\Cypher-Rat-Source-Code-main\Cypher-Rat-Source-Code-main\PATCH7\app\build\intermediates\incremental\payloadRelease-mergeJavaRes\zip-cache\EWRxmQ23dLH_TPwuqdNsXCuOuyk=

Filesize
20KB

MD5
5819d27a0cd34b9ce2763d55353a2512

SHA1
207a6efae6a3555e326de41f76bdadd9a239cbce

SHA256
8d378e88ebd5189e09eef623414812c868fd90aa519d6160e2311fb8b81cff56

SHA512
dc6c0e7dd652d8894dd0d02e6afbe2720432f36c5979e854540c6117ee558fa556527ab849b5529b4904b44a7e99b77094e620ae6d055cc4a8bc4a331af85439

Download Submit
C:\Users\Admin\Downloads\Cypher-Rat Latest Paid (3)\Cypher-Rat Latest Paid\Cypher Source + Rat\Cypher-Rat-Source-Code-main\Cypher-Rat-Source-Code-main\PATCH7\app\build\intermediates\incremental\payloadRelease-mergeJavaRes\zip-cache\UI7Ip3UnQtC0ZgCrj9gsVMEnqrY=

Filesize
27KB

MD5
f0adda996629f4b660b6ad3ac03286a5

SHA1
2e85417e7990657be8fe07d63fd5278d82eb960e

SHA256
6225f295cc6abc88e509d7e44b8f98d1c7436bc8c360398617ef05db0dbc8d41

SHA512
4301c36d16c668348dbc145f486abe491f6a533ae30d5860c81b618b29bdab0f9bcc93b7724c99d75408578cfa13813ae042c557cfd1ef9fc435a082d1aec001

Download Submit
C:\Users\Admin\Downloads\Cypher-Rat Latest Paid (3)\Cypher-Rat Latest Paid\Cypher Source + Rat\Cypher-Rat-Source-Code-main\Cypher-Rat-Source-Code-main\PATCH7\app\build\intermediates\incremental\payloadRelease-mergeJavaRes\zip-cache\b3qTR18lK87jV7KaB6cbbYk6boU=

Filesize
11KB

MD5
062abc0c2bb4bf29b13aea6d31262c07

SHA1
e55b70d1f5620db124b3e85a7f4bdc7bd48d9f95

SHA256
3a616a32f433e9e23f556b38575c31b013613d3ae85206263b7625fe1f4c151a

SHA512
10ce217dab1200810d85872c68cf19b5dedb2cbfdfed8f61f2d8b1d25e192a9bcfc1e1a9303782dff188bd2dce14de9225e28a6d21df8ce5fabf0514d2579a7d

Download Submit
C:\Users\Admin\Downloads\Cypher-Rat Latest Paid (3)\Cypher-Rat Latest Paid\Cypher Source + Rat\Cypher-Rat-Source-Code-main\Cypher-Rat-Source-Code-main\PATCH7\app\build\intermediates\incremental\payloadRelease-mergeJavaRes\zip-cache\dW4hDP2V1FZkjeRrFpQC36IDKpE=

Filesize
8KB

MD5
1cf4520b28b422b847f6193531840ede

SHA1
a69067467c7e4d5c810ea19ee43cbfab00a292b4

SHA256
d2847f3840015a91b58199e941a2a0d67f0738661dba44aef94a0eee504a34cd

SHA512
eff4912e03da7984fc68efd1b2491d32ec812b2d02aeaf68aeb8656bf88d7ab18274164e161ff560042791d97d940f020f1e0e3f47af3260f1fe67bf700f9b9d

Download Submit
C:\Users\Admin\Downloads\Cypher-Rat Latest Paid (3)\Cypher-Rat Latest Paid\Cypher Source + Rat\Cypher-Rat-Source-Code-main\Cypher-Rat-Source-Code-main\PATCH7\app\build\intermediates\incremental\payloadRelease-mergeJavaRes\zip-cache\pbGKHwbc5fXQmk2jJl2spT77_V8=

Filesize
27KB

MD5
46efec36398d1479da563d09b7e7104f

SHA1
ed73f5337a002d1fd24339d5fb08c2c9d9ca60d8

SHA256
5d5b9414f02d3fa0ee7526b8d5ddae0da67c8ecc8c4d63ffa6cf91488a93b927

SHA512
8a3cf8ca25e328ac8da7d1310bbb19c775ba9b93ce249f0c80ae85229ec96a0ebdeb89af5bafb543d4ca78f859b28a4fa20683bae1a04c56ba5e9f791ee0ec4a

Download Submit
C:\Users\Admin\Downloads\Cypher-Rat Latest Paid (3)\Cypher-Rat Latest Paid\Cypher Source + Rat\Cypher-Rat-Source-Code-main\Cypher-Rat-Source-Code-main\PATCH7\app\build\intermediates\incremental\payloadRelease-mergeJavaRes\zip-cache\qw14fsLPU0ylKeP40UwSlzBjvLg=

Filesize
612KB

MD5
e1bfd74687df6ff675424eda859dd18b

SHA1
ddfc0d219f43bf3c1e357a55284cbd1000e461bf

SHA256
b1fe91268aa9d0e5c4a6d5ddeb1e39dabcd2d6627ccde1f530a7b799e9b4bb82

SHA512
283f31f7555b846f9966c4eb8421438f7c4e998f13aebe468749bb5ba43e91c2b4c9c240dbbcb5f50b808091a3f92c319426f5e48d3cc20c7fd5346122d2ff6d

Download Submit
C:\Users\Admin\Downloads\Cypher-Rat Latest Paid (3)\Cypher-Rat Latest Paid\Cypher Source + Rat\Cypher-Rat-Source-Code-main\Cypher-Rat-Source-Code-main\PATCH7\app\build\intermediates\incremental\payloadRelease-mergeJavaRes\zip-cache\qyCzdXk_UrhsYl8NtGFEDN1kBkY=

Filesize
60KB

MD5
168c4050b7f99cb0018e4f41b804f742

SHA1
b15c6ded887ad967e20bb335c1a121b253c04dce

SHA256
7abc2d7848fdf9f72ec00bcb5a1ebf914488ec06039990dd04dce51165966aab

SHA512
3ddac93208c7f1f71b5b17022ebf89755f459a4000460060c67a2cea540abc0858bfa4eda2932abdafe80e1d2122b552150db677ac6241f4a97cb74d17a64275

Download Submit
C:\Users\Admin\Downloads\Cypher-Rat Latest Paid (3)\Cypher-Rat Latest Paid\Cypher Source + Rat\Cypher-Rat-Source-Code-main\Cypher-Rat-Source-Code-main\PATCH7\app\src\main\res\b.png

Filesize
165B

MD5
ec144826a7fffb75261ce6429f535eb0

SHA1
2ba96e3584d28296d9d3cb2a1e35d306c894b34d

SHA256
b1d259c3388c3fdfedf97ecaf8ecdb27530873002ea08bbec0d4a65a04bbcf1d

SHA512
c6842572b0923a27e2f05a28b11995ed312a04d4d9a2120c92c113a11124ecb74d19dc25977d89da59690807fb74bae333add96d80872cfa9341587c5e533083

Download Submit
C:\Users\Admin\Downloads\Cypher-Rat Latest Paid (3)\Cypher-Rat Latest Paid\Cypher Source + Rat\Cypher-Rat-Source-Code-main\Cypher-Rat-Source-Code-main\packages\System.IO.Compression.ZipFile.4.3.0\ref\net46\System.IO.Compression.ZipFile.dll

Filesize
24KB

MD5
dcda916372128f13ada8b07026c1b3e7

SHA1
99d6c187de8510206a93d2eed9c65e65e0c86e72

SHA256
b5c12e9099643e2eda9b49edd0d98bdaed153c72a7e8e6235d8e78714402d16a

SHA512
d66de5d61cf7090ce2e11ca8064723a44c2fdbd7ed937f1cf4198ebe13083037941b816ad9022d332bbb853666785600fa8b1faca94c498d2f82de73fe1e42f9

Download Submit
C:\Users\Admin\Downloads\Email Spoofer by.zip

Filesize
428KB

MD5
05cf40c45140e543d733c4706a4ebe98

SHA1
a4451beedc8585be822382cd0d10c3f4d0df91a2

SHA256
82444b10a68dd5456559978e22fb18e71a0b42e4d18a69f10ff8231381133cc2

SHA512
e7b28d5e720befdd9bca8135726e45be3bd621f01b5b99b26b1f65b37ff4f32b4ac7abf95cc35f683aa585fb5ec1b454ed3638232470b31b2a92ffdba41d7757

Download Submit
C:\Users\Admin\Downloads\Email Spoofer by.zip.crdownload

Filesize
428KB

MD5
05cf40c45140e543d733c4706a4ebe98

SHA1
a4451beedc8585be822382cd0d10c3f4d0df91a2

SHA256
82444b10a68dd5456559978e22fb18e71a0b42e4d18a69f10ff8231381133cc2

SHA512
e7b28d5e720befdd9bca8135726e45be3bd621f01b5b99b26b1f65b37ff4f32b4ac7abf95cc35f683aa585fb5ec1b454ed3638232470b31b2a92ffdba41d7757

Download Submit
C:\Users\Admin\Downloads\Email Spoofer by\Email Spoofer.exe

Filesize
478KB

MD5
6b904b8237434167eff89305ac8d222f

SHA1
5f3aea3cfb92c5a1cad4b9578c282d9e3220bdac

SHA256
bef1df4b3ab141089a2f0ddc682d04644fd4225294decf8f750d5fc35030e74a

SHA512
a3c824bd71f6d8ea9917794700470a76e215faf5bb64d4de5354ae910c280263fb137a934830468580b2a2805d93cc708e11fc3d54dd852106882b104cbaafd8

Download Submit
C:\Users\Admin\Downloads\Redline.rar.crdownload

Filesize
14.6MB

MD5
319528db2efe3c3c70f2055c2124cde0

SHA1
65d0f7a4fadf37c31b36b3f7cc8a41aaa900a948

SHA256
d3a8158d46db1f8476fc7ebef93bd600fbda04bba4bdf9af280f8f9ed6ba1d62

SHA512
4d6934a174ea25e345ea1ab271fe2ba13212f09d67f8237077c66563aaefa5fe2f6cf8943871f320cd3c57f2d72e107a59df898b3c2c15d8428c9b15f56b69c2

Download Submit
C:\Users\Admin\Downloads\Revenge_Clean-version.zip.crdownload

Filesize
14.5MB

MD5
3d9424d426f9baf7f87f0b479cda1930

SHA1
6f0c672d9d2e7825c73d4ab3d50d9402f8c10d80

SHA256
d85d8507702632e0dac621c71f69dfa397a873f31b0161c2ea9d815a6a0257f1

SHA512
835bd491bbce61a6a4c79fb13314e824c6cba0493b0c5fdf8a3519b2abccd14d731af3a498f4f91e86c8577ceb062c174fde281822da78d7126844753c1f623a

Download Submit
C:\Users\Admin\Downloads\Revenge_Clean-version\Revenge-RAT v0.3\Database\2023-04-24\9-21-20 AM.log

Filesize
98B

MD5
a29de60fab7e1011e2c15819699cc14a

SHA1
4736d73de77ef870dabdfd6dcf52dd70f45e753f

SHA256
5b2590ffde287a2b1bc922712c55a4ee77deaa618ab89bafd61fe5fb775fc2d8

SHA512
eaaeaa9f24b095c0bca047e77ca0bfae9ced1accb44fad6d00902dada8d5e4ec9bc0fb9a09ea6230e74784a09e199fc57b3dee05076c76d83e1ca6ccc29a591d

Download Submit
C:\Users\Admin\Downloads\Revenge_Clean-version\Revenge-RAT v0.3\Icons\Onedrive.ico

Filesize
361KB

MD5
257440f1449c4505669d278bf431405c

SHA1
5235870185889ffa48234f1f4af14647634c19ef

SHA256
a3c9e33dafb4c829a57a81ba8a6d94c2da9b343b6f9d6c933a4b5b88bbd96495

SHA512
d99bf41a9017dcef261fc9886887fdeb3d3b6db806d92d8f76c783764caa7f94738b7258750a5fb26cb6069f471d1acfb55dc79db5855a5619e9d864e74761a7

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 726543.crdownload

Filesize
1.4MB

MD5
0f774e364b59d81f9396b075da92c10e

SHA1
8b5c78682e0fcc358dc37a24a8ad8e46847db1fd

SHA256
c46aa513b122786e133064af1b8d59293bcdedead298c6087f17d03a2ed096c5

SHA512
ab60a1f72a66d7cea5c85650d5b6fa182a88a5014549c1b94114b445b91e22af51e9fbf2693c967c7a7bca1a93f75a8b7673e371ec9037344bf095752b9bc214

Download Submit
C:\Users\Admin\Downloads\binder.rar.crdownload

Filesize
733KB

MD5
55d4a129b7e3f73b7423992f68d9ba86

SHA1
c75374a0c3462fc9b1449d31244a80c4ce6faf87

SHA256
792d9fa63ea7f4e9f1780ec038685401fe6c495fca315bbaa5b8158421027dfe

SHA512
554d9e515e76d7a182443c5e296c1472806b41f85c511bd25dff0771b3ac1912f817e0fa3403c4d7835aade360b49d709c7b6fc0176bf9bf046ca259156f3e4c

Download Submit
C:\Users\Admin\Downloads\ndp481-web.exe

Filesize
1.4MB

MD5
0f774e364b59d81f9396b075da92c10e

SHA1
8b5c78682e0fcc358dc37a24a8ad8e46847db1fd

SHA256
c46aa513b122786e133064af1b8d59293bcdedead298c6087f17d03a2ed096c5

SHA512
ab60a1f72a66d7cea5c85650d5b6fa182a88a5014549c1b94114b445b91e22af51e9fbf2693c967c7a7bca1a93f75a8b7673e371ec9037344bf095752b9bc214

Download Submit
C:\Users\Admin\Downloads\ndp481-web.exe

Filesize
1.4MB

MD5
0f774e364b59d81f9396b075da92c10e

SHA1
8b5c78682e0fcc358dc37a24a8ad8e46847db1fd

SHA256
c46aa513b122786e133064af1b8d59293bcdedead298c6087f17d03a2ed096c5

SHA512
ab60a1f72a66d7cea5c85650d5b6fa182a88a5014549c1b94114b445b91e22af51e9fbf2693c967c7a7bca1a93f75a8b7673e371ec9037344bf095752b9bc214

Download Submit
C:\Users\Admin\Downloads\pico-ducky-v1.4_us.zip.crdownload

Filesize
570KB

MD5
3aabf7fda9bfc5cd1f896b634d14699f

SHA1
2174cc523488560a0554a89477e87d06df6e0a33

SHA256
443cf4f8d42158649bedc96f86c692af113121df955ebf1ba35fe0e11e466ecc

SHA512
bffcb791d3dc85ee5b521cf58bcec2f092aa2235b2845f0be269c0a16327d351c0d1ab4b5dcdcce6a30183185a4f96cfc768245db4f82bb813dfe62edd19b968

Download Submit
C:\Users\Admin\Downloads\ready_encrypted_src.apk.crdownload

Filesize
6.1MB

MD5
68f113b1f1293a01f6f1df78bc70dddb

SHA1
c28a4cf514ff7fe7b4b8243c44bd661a968d668d

SHA256
a5286ac1f56198545d430de1f4015c57f360c8120b3efc8a9bd67806fbe1b99a

SHA512
027c5bb1e741136649cc5a542ab8562f2402d69cb13e9735a9da1a0303c53aed193d8f7ca08563043585f1a867668793dd34017ceff32457564aa8275bab46d9

Download Submit
C:\Users\Admin\Downloads\ready_src.apk.crdownload

Filesize
3.2MB

MD5
70774e77b4b95f2b471ec505c65615e5

SHA1
a534f59acd3b801e573831be252a9c13925e726a

SHA256
17c0e39fa69183ecc597c640473fa6a8a05187f16949416f5d8bd9638b587eae

SHA512
24a27f4bdaa1a520b042307e1dba12813bd9ca489210677344adf1bcea2c53a78c3df4b505bfbb8733cef4b126bae009ea7b6c7e97305d123dbcdb7277b83be5

Download Submit
memory/1056-7316-0x0000000000510000-0x0000000003E9C000-memory.dmp

Filesize
57.5MB

Download
memory/1056-7318-0x0000000004800000-0x0000000004810000-memory.dmp

Filesize
64KB

Download
memory/1056-7320-0x000000000B620000-0x000000000B676000-memory.dmp

Filesize
344KB

Download
memory/1056-7319-0x00000000063B0000-0x000000000644C000-memory.dmp

Filesize
624KB

Download
memory/1056-7317-0x0000000004800000-0x0000000004810000-memory.dmp

Filesize
64KB

Download
memory/4436-7451-0x00007FF929C20000-0x00007FF929C21000-memory.dmp

Filesize
4KB

Download
memory/4436-8791-0x000000001EC50000-0x000000001ED50000-memory.dmp

Filesize
1024KB

Download
memory/4436-9078-0x000000001EC50000-0x000000001ED50000-memory.dmp

Filesize
1024KB

Download
memory/4436-8975-0x000000001EC50000-0x000000001ED50000-memory.dmp

Filesize
1024KB

Download
memory/4436-8890-0x000000001EC50000-0x000000001ED50000-memory.dmp

Filesize
1024KB

Download
memory/4436-8701-0x000000001EC50000-0x000000001ED50000-memory.dmp

Filesize
1024KB

Download
memory/4436-8599-0x000000001EC50000-0x000000001ED50000-memory.dmp

Filesize
1024KB

Download
memory/4436-8596-0x000000001AE30000-0x000000001AE40000-memory.dmp

Filesize
64KB

Download
memory/4436-8594-0x000000001AE30000-0x000000001AE40000-memory.dmp

Filesize
64KB

Download
memory/4436-8490-0x000000001AE30000-0x000000001AE40000-memory.dmp

Filesize
64KB

Download
memory/4436-8376-0x000000001EC50000-0x000000001ED50000-memory.dmp

Filesize
1024KB

Download
memory/4436-8374-0x000000001AE30000-0x000000001AE40000-memory.dmp

Filesize
64KB

Download
memory/4436-8289-0x000000001EC50000-0x000000001ED50000-memory.dmp

Filesize
1024KB

Download
memory/4436-8077-0x000000001EC50000-0x000000001ED50000-memory.dmp

Filesize
1024KB

Download
memory/4436-7987-0x000000001EC50000-0x000000001ED50000-memory.dmp

Filesize
1024KB

Download
memory/4436-7767-0x000000001EC50000-0x000000001ED50000-memory.dmp

Filesize
1024KB

Download
memory/4436-7651-0x000000001EC50000-0x000000001ED50000-memory.dmp

Filesize
1024KB

Download
memory/4436-7533-0x000000001AE30000-0x000000001AE40000-memory.dmp

Filesize
64KB

Download
memory/4436-7534-0x000000001AE30000-0x000000001AE40000-memory.dmp

Filesize
64KB

Download
memory/4436-7509-0x000000001AE30000-0x000000001AE40000-memory.dmp

Filesize
64KB

Download
memory/4436-7473-0x00007FF929EA0000-0x00007FF929EA1000-memory.dmp

Filesize
4KB

Download
memory/4436-7476-0x00007FF929E90000-0x00007FF929E91000-memory.dmp

Filesize
4KB

Download
memory/4436-7472-0x00007FF929F50000-0x00007FF929F51000-memory.dmp

Filesize
4KB

Download
memory/4436-7470-0x00007FF929F60000-0x00007FF929F61000-memory.dmp

Filesize
4KB

Download
memory/4436-7468-0x00007FF92A300000-0x00007FF92A301000-memory.dmp

Filesize
4KB

Download
memory/4436-7469-0x00007FF92A2F0000-0x00007FF92A2F1000-memory.dmp

Filesize
4KB

Download
memory/4436-7464-0x000000001DAF0000-0x000000001DAFA000-memory.dmp

Filesize
40KB

Download
memory/4436-7423-0x000000001DDB0000-0x000000001DEF2000-memory.dmp

Filesize
1.3MB

Download
memory/4436-7437-0x000000001AC60000-0x000000001AE00000-memory.dmp

Filesize
1.6MB

Download
memory/4436-7438-0x00000000020A0000-0x00000000020A1000-memory.dmp

Filesize
4KB

Download
memory/4436-7441-0x00007FF929C30000-0x00007FF929C31000-memory.dmp

Filesize
4KB

Download
memory/4436-7443-0x00007FF92A310000-0x00007FF92A311000-memory.dmp

Filesize
4KB

Download
memory/4436-7447-0x00007FF929EC0000-0x00007FF929EC1000-memory.dmp

Filesize
4KB

Download
memory/4436-7445-0x00007FF929F80000-0x00007FF929F81000-memory.dmp

Filesize
4KB

Download
memory/4436-7449-0x00007FF929EB0000-0x00007FF929EB1000-memory.dmp

Filesize
4KB

Download
memory/4436-7467-0x00007FF929EF0000-0x00007FF929EF1000-memory.dmp

Filesize
4KB

Download
memory/4436-7453-0x00007FF929C60000-0x00007FF929C61000-memory.dmp

Filesize
4KB

Download
memory/4436-7455-0x00007FF92A320000-0x00007FF92A321000-memory.dmp

Filesize
4KB

Download
memory/4436-7457-0x00007FF929ED0000-0x00007FF929ED1000-memory.dmp

Filesize
4KB

Download
memory/4436-7459-0x00007FF929EE0000-0x00007FF929EE1000-memory.dmp

Filesize
4KB

Download
memory/4436-7462-0x00007FF929F20000-0x00007FF929F21000-memory.dmp

Filesize
4KB

Download
memory/4436-7466-0x00007FF929C50000-0x00007FF929C51000-memory.dmp

Filesize
4KB

Download
memory/4436-7461-0x00007FF929F00000-0x00007FF929F01000-memory.dmp

Filesize
4KB

Download
memory/4436-7465-0x000000001AE30000-0x000000001AE40000-memory.dmp

Filesize
64KB

Download
memory/4592-763-0x0000000005270000-0x0000000005316000-memory.dmp

Filesize
664KB

Download
memory/4592-765-0x0000000005270000-0x0000000005316000-memory.dmp

Filesize
664KB

Download
memory/4592-767-0x0000000005270000-0x0000000005316000-memory.dmp

Filesize
664KB

Download
memory/4592-769-0x0000000005270000-0x0000000005316000-memory.dmp

Filesize
664KB

Download
memory/4592-771-0x0000000005270000-0x0000000005316000-memory.dmp

Filesize
664KB

Download
memory/4592-773-0x0000000005270000-0x0000000005316000-memory.dmp

Filesize
664KB

Download
memory/4592-775-0x0000000005270000-0x0000000005316000-memory.dmp

Filesize
664KB

Download
memory/4592-777-0x0000000005270000-0x0000000005316000-memory.dmp

Filesize
664KB

Download
memory/4592-779-0x0000000005270000-0x0000000005316000-memory.dmp

Filesize
664KB

Download
memory/4592-781-0x0000000005270000-0x0000000005316000-memory.dmp

Filesize
664KB

Download
memory/4592-783-0x0000000005270000-0x0000000005316000-memory.dmp

Filesize
664KB

Download
memory/4592-785-0x0000000005270000-0x0000000005316000-memory.dmp

Filesize
664KB

Download
memory/4592-787-0x0000000005270000-0x0000000005316000-memory.dmp

Filesize
664KB

Download
memory/4592-789-0x0000000005270000-0x0000000005316000-memory.dmp

Filesize
664KB

Download
memory/4592-791-0x0000000005270000-0x0000000005316000-memory.dmp

Filesize
664KB

Download
memory/4592-793-0x0000000005270000-0x0000000005316000-memory.dmp

Filesize
664KB

Download
memory/4592-1790-0x0000000004C00000-0x0000000004C10000-memory.dmp

Filesize
64KB

Download
memory/4592-1794-0x0000000004C00000-0x0000000004C10000-memory.dmp

Filesize
64KB

Download
memory/4592-1792-0x0000000004C00000-0x0000000004C10000-memory.dmp

Filesize
64KB

Download
memory/4592-3205-0x0000000005320000-0x00000000053B2000-memory.dmp

Filesize
584KB

Download
memory/4592-3206-0x00000000057B0000-0x00000000057BA000-memory.dmp

Filesize
40KB

Download
memory/4592-3207-0x0000000004C00000-0x0000000004C10000-memory.dmp

Filesize
64KB

Download
memory/4592-3208-0x0000000004C00000-0x0000000004C10000-memory.dmp

Filesize
64KB

Download
memory/4592-3226-0x0000000004C00000-0x0000000004C10000-memory.dmp

Filesize
64KB

Download
memory/4592-3209-0x0000000004C00000-0x0000000004C10000-memory.dmp

Filesize
64KB

Download
memory/4592-3224-0x0000000004C00000-0x0000000004C10000-memory.dmp

Filesize
64KB

Download
memory/4592-3225-0x0000000004C00000-0x0000000004C10000-memory.dmp

Filesize
64KB

Download
memory/4592-761-0x0000000005270000-0x0000000005316000-memory.dmp

Filesize
664KB

Download
memory/4592-759-0x0000000005270000-0x0000000005316000-memory.dmp

Filesize
664KB

Download
memory/4592-757-0x0000000005270000-0x0000000005316000-memory.dmp

Filesize
664KB

Download
memory/4592-755-0x0000000005270000-0x0000000005316000-memory.dmp

Filesize
664KB

Download
memory/4592-753-0x0000000005270000-0x0000000005316000-memory.dmp

Filesize
664KB

Download
memory/4592-751-0x0000000005270000-0x0000000005316000-memory.dmp

Filesize
664KB

Download
memory/4592-749-0x0000000005270000-0x0000000005316000-memory.dmp

Filesize
664KB

Download
memory/4592-747-0x0000000005270000-0x0000000005316000-memory.dmp

Filesize
664KB

Download
memory/4592-745-0x0000000005270000-0x0000000005316000-memory.dmp

Filesize
664KB

Download
memory/4592-743-0x0000000005270000-0x0000000005316000-memory.dmp

Filesize
664KB

Download
memory/4592-741-0x0000000005270000-0x0000000005316000-memory.dmp

Filesize
664KB

Download
memory/4592-737-0x0000000004C00000-0x0000000004C10000-memory.dmp

Filesize
64KB

Download
memory/4592-739-0x0000000004C00000-0x0000000004C10000-memory.dmp

Filesize
64KB

Download
memory/4592-738-0x0000000005270000-0x0000000005316000-memory.dmp

Filesize
664KB

Download
memory/4592-735-0x0000000004C00000-0x0000000004C10000-memory.dmp

Filesize
64KB

Download
memory/4592-734-0x0000000005270000-0x0000000005316000-memory.dmp

Filesize
664KB

Download
memory/4592-732-0x0000000005270000-0x0000000005316000-memory.dmp

Filesize
664KB

Download
memory/4592-730-0x0000000005270000-0x0000000005316000-memory.dmp

Filesize
664KB

Download
memory/4592-728-0x0000000005270000-0x0000000005316000-memory.dmp

Filesize
664KB

Download
memory/4592-727-0x0000000005270000-0x0000000005316000-memory.dmp

Filesize
664KB

Download
memory/4592-726-0x0000000004CC0000-0x0000000005264000-memory.dmp

Filesize
5.6MB

Download